v1.2 mobile PWA: installable app + mobile-first UI

- Installable PWA: manifest.json (standalone, portrait, maskable icons),
  theme-color + apple-mobile-web-app meta, generated 192/512 PNG icons,
  service worker (network-first, never caches /api/).
- Mobile UI (≤720px): sticky blurred header, agent grid -> horizontal
  snap-scroll carousel, fixed bottom composer with safe-area insets,
  modals -> full-screen bottom sheets, 16px inputs (no iOS zoom), bigger
  touch targets, icon-only header actions.
- /app remains the app shell; / is the landing page.

static/sw.js

@@ -0,0 +1,31 @@
+const CACHE = 'astraea-v1';
+const ASSETS = ['/', '/static/manifest.json', '/static/icon-192.png', '/static/icon-512.png'];
+
+self.addEventListener('install', (e) => {
+  e.waitUntil(caches.open(CACHE).then((c) => c.addAll(ASSETS)).then(() => self.skipWaiting()));
+});
+
+self.addEventListener('activate', (e) => {
+  e.waitUntil(
+    caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))))
+      .then(() => self.clients.claim())
+  );
+});
+
+// Network-first for everything except static assets (the app shell is tiny;
+// API responses must never be served stale).
+self.addEventListener('fetch', (e) => {
+  const url = new URL(e.request.url);
+  if (e.request.method !== 'GET') return;
+  if (url.pathname.startsWith('/api/')) return; // always live
+
+  e.respondWith(
+    fetch(e.request)
+      .then((resp) => {
+        const copy = resp.clone();
+        caches.open(CACHE).then((c) => c.put(e.request, copy));
+        return resp;
+      })
+      .catch(() => caches.match(e.request).then((c) => c || caches.match('/')))
+  );
+});