Make the frontend an installable PWA

Add a web app manifest and an install-only service worker (no offline
caching: live state always comes from the server and hashed asset names
change every build), registered from the WASM bundle. The worker must
live at the site root for its scope to cover the app, and Granian only
serves /static and /assets, so tavolo/static.py answers
/manifest.webmanifest and /sw.js from STATIC_DIR with the content types
browsers require; index.html gains the manifest link, icons, theme-color
and Apple standalone meta tags.

Icons are committed under web/assets/icons/ with vector sources and a
make-icons.sh regeneration script, mirroring the card art workflow.

web/src/main.rs

@@ -4,6 +4,7 @@ mod auth;
 mod components;
 mod model;
 mod pages;
+mod pwa;
 mod ws;
 
 use sycamore::prelude::*;
@@ -91,5 +92,6 @@ fn main() {
             )
         }
     });
+    pwa::register();
     restore_page_after_login();
 }

web/src/pwa.rs

@@ -0,0 +1,20 @@
+//! Service worker registration.
+//!
+//! Registering `/sw.js` is what makes the app installable as a PWA; the
+//! worker itself is install-only (no offline caching — see `web/sw.js`).
+//! Registration is best-effort: browsers without service worker support,
+//! and insecure origins other than localhost, simply skip it.
+use wasm_bindgen_futures::{spawn_local, JsFuture};
+
+/// Register the service worker, if the browser supports it.
+pub fn register() {
+    let Some(window) = web_sys::window() else {
+        return;
+    };
+    let container = window.navigator().service_worker();
+    spawn_local(async move {
+        // Rejections (e.g. insecure origin) are ignored: the app works
+        // without a service worker, it just is not installable.
+        let _ = JsFuture::from(container.register("/sw.js")).await;
+    });
+}