PWA: manifest, icons, and a service worker that never caches /api/*

[eaitbrahim]

Spec: docs/superpowers/specs/2026-08-23-web-ui-rewrite-design.md § Service worker.

Depends on #536 (shell).

This works because the origin is localhost

http://127.0.0.1 is a secure context by specification, so the service worker, the web app manifest and browser install all work from the local server with no networking decision, no certificate and no tunnel.

Recorded because it is the first thing anyone proposes otherwise: the app cannot be served from keeltrading.com. keel's data is a local SQLite file; a page on that origin cannot read it, and an HTTPS page fetching http://127.0.0.1:8765 is exactly the path browsers are closing — Private Network Access preflights in Chrome, blocked in Safari. The exits are a TLS certificate for the local server (needs a tunnel) or a hosted service (a different product). Neither is in scope.

Phones are out of scope — excluded by the architecture, not deferred. There is no keel on iOS or Android.

Routing is explicit, and the rule is the point

A PWA caching financial data is actively dangerous: opening the app to last week's equity styled as current is worse than an error.

route	strategy
index.html, .js, .css, icons	CacheFirst
/api/*	NetworkOnly, no exceptions

If the engine is not running the shell loads instantly and reports it. It never shows a cached account balance.

Cache key is the build version

CacheFirst on index.html means an upgraded engine could otherwise be met by a stale shell holding an older contract — a subtler failure than the one the routing prevents. The cache name is keyed to the version from GET /api/config (#534).

Acceptance

• Installable from http://127.0.0.1:8765 on desktop Chrome/Edge; Safari behaviour recorded either way.
• A test or scripted check asserts no /api/* response is ever written to a cache.
• With the engine stopped, the installed app opens and says so — no cached figures anywhere on screen.
• Bumping the version invalidates the shell cache; an old shell never talks to a new API.
• Manifest, icons and service worker are served from the local origin with no external fetch.