feat(web): installable, with a worker that structurally cannot cache a balance (#538)

[eaitbrahim]

Closes #538. Stacked on #550 (feat-537-remaining-views) — that PR was still open when this
branched, so review it after #550 lands; I'll rebase onto main then.

Manifest, icons and a service worker, so keel serve installs as a desktop app and opens to the
shell — and its own honest banner — when the engine is not running.

The API rule is enforced by scope, not by care

sw.js ships at the static root, so its registration scope is /static/ and /api/* is
outside it. A worker's fetch handler is never invoked for a request outside its own scope — not
skipped, not returned early from: the browser does not consult it. No edit to that file can cache
an API response, because no edit to that file can see one. Two further layers back it up: the only
cache write in the module is addAll(PRECACHE) (no runtime put, pinned by a test), and an
explicit /api/ guard in fetch — dead code today, pinned by a test that says so, because #540
widens the scope to / and it stops being redundant on the day nobody is thinking about it.

This is where the implementation departs from the spec's file list, which puts sw among the
modules in js/. js/sw.js is scoped to /static/js/ and cannot answer a navigation to
/static/insights. The alternative — a Service-Worker-Allowed header widening the scope from
js/ — was rejected for failing silently: remove the header and the worker still installs, still
activates, and simply stops controlling the app. The spec is amended in place rather than quietly
diverged from.

The icons are generated, because four binary blobs are not reviewable

scripts/build_icons.py defines the mark once as three stroke coordinates and emits the SVG and
all three PNGs from it, with a stdlib rasteriser — point-in-polygon and zlib.compress, no Pillow.
--check re-renders and compares bytes, and a test runs it, so a hand-edited PNG fails and a
deliberate change has to be made where it is legible in a diff.

The mark is a monogram, and that was decided by looking. Three nautical marks were drawn and
rendered first — a hull in section over a keel, a hull in profile with a fin, a bulb keel — and at
icon size each read as something else: a funnel, a letter T, and an exclamation mark on a saucer.

One attribute decides whether any of this installs

<link rel="manifest"> is fetched with credentials mode omit by default, and every response
this server sends is gated on the session cookie. Without crossorigin="use-credentials" the
manifest fetch is a 403, the browser reports no manifest, and the app is not installable — with
nothing in the page or the console pointing at the cause.

Verification

ruff, mypy and the full suite are green (4854 passed, 3 skipped), and 28 new tests cover the
shipped bytes and the wire. Two of them were mutation-checked: dropping chart.js from PRECACHE
and adding an unlisted asset both fail test_every_shipped_asset_is_either_precached_or_exempt.

The rest is what Python cannot prove, driven in a real Chromium against a snapshot of the live
155 MB deployment database:

check	result
worker installs, activates, controls	activated, scope http://127.0.0.1:8793/static/
cache name carries the build	keel-shell-0.11.2+88fb17bcab15 — the + survived, as %2B on the wire
precache contents	exactly the 13 declared files; no /api/ entry
manifest without credentials	403 (worker unregistered, so the server answered)
manifest with credentials	200
engine stopped, deep link to /static/insights	shell paints, banner reads "keel isn't running — the local server at this address did not answer", nav intact, zero currency figures on screen
build bump 0.11.2+… → 0.12.0+…	old cache deleted, new cache created with 13 entries, no /api/ entry

Chrome's installability checklist is satisfied item by item — localhost is a secure context, name
and short_name present, start_url inside scope and on a real client route, display: standalone, a 192px and a 512px PNG plus a separate maskable, and a worker with a fetch handler.
I did not trigger the install prompt itself, and Safari is not verified here — recorded as
unverified rather than assumed, per the issue's "Safari behaviour recorded either way".

Packaging needed no change and is already covered:
test_static_assets_survive_being_built_into_a_wheel walks the static tree against a real uv build, and test_freeze.py pins keel.web.static into the PyInstaller bundle — so the icons ship
with the desktop build for the same reason the stylesheet does.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T6yA5khYnJ2qzheArRToQ2