swarm-ui: make it installable as a PWA

Closes #4282. mara: "scope looks good" — approving the plan posted
there (manifest + icons + minimal shell-only service worker + iOS meta
tags) and both explicit questions (network-first-with-offline-fallback,
never cache /api/*).

docs/web-ui/design-guide.md's "Layout & viewport" section already
asserted swarm-ui is installable as a PWA — this is what actually backs
it.

- manifest.webmanifest: name/icons/start_url/standalone display, theme
  #cba6f7 / background #1e1e2e matching the mocha --purple/--bg values.
- sw.js: plain JS, not TypeScript — the DOM lib swarm-ui's own tsconfig
  uses and the WebWorker lib a service worker's globals need are
  mutually exclusive in one tsc program, not worth a second tsconfig for
  a self-contained ~100-line file. Scoped to the app shell only, never
  touches /api/* at all, network-first with offline-fallback-to-cache
  (not cache-first) since main.js/main.css are unhashed filenames and a
  cache-first SW would risk wedging an operator on stale JS after a
  deploy.
- index.html: manifest link, theme-color meta, iOS
  apple-mobile-web-app-* tags (Safari ignores the manifest spec).
- main.tsx: feature-detected SW registration.
- branding/hyperhive-maskable.svg: hyperhive.svg's own artwork already
  fills nearly its whole canvas, so a maskable icon needs a padded
  variant or an OS mask crops the outer ring/corner brackets — embeds
  the original via a scaled <image> ref rather than duplicating markup.
- nix/packages/swarm-ui.nix: rasterizes icon-192/512/512-maskable.png
  from the branding SVGs at build time via librsvg, rather than
  checking in static PNGs.

Verified for real: typecheck+build green, and a real headless-chromium
tab driven over CDP confirms the service worker registers and becomes
the active controller, and a simulated-offline reload still serves the
full cached shell rather than a browser error page. nix build .#swarm-ui
also verified green, including the rasterized icon output.

nix/packages/default.nix

@@ -197,6 +197,7 @@ in
   # `packages.default`'s closure.
   swarm-ui = pkgs.callPackage ./swarm-ui.nix {
     branding-svg = ../../branding/hyperhive.svg;
+    branding-svg-maskable = ../../branding/hyperhive-maskable.svg;
   };
 
   # Bundled browser assets — see ./frontend.nix. Output is

nix/packages/swarm-ui.nix

@@ -1,4 +1,9 @@
-{ buildNpmPackage, branding-svg }:
+{
+  buildNpmPackage,
+  branding-svg,
+  branding-svg-maskable,
+  librsvg,
+}:
 
 # Static build of the swarm-level UI shell (project-bootstrap scope:
 # empty start page, no functionality yet — see
@@ -31,6 +36,14 @@
 # `./frontend.nix` copies for the dashboard) is likewise copied in
 # during install — it lives outside the npm tree.
 
+# PWA icons: rasterized from the branding SVGs at build time via
+# `librsvg`'s `rsvg-convert` rather than checking in static PNGs, so the
+# SVG stays the one thing to update if the mark ever changes.
+# `branding-svg-maskable` is a separate, padded source (see
+# `branding/hyperhive-maskable.svg`'s own comment) — `hyperhive.svg`'s
+# artwork already fills nearly its whole canvas, so a maskable icon needs
+# real margin or an OS mask crops into it.
+
 buildNpmPackage {
   pname = "hyperhive-swarm-ui";
   version = "0.0.0";
@@ -39,6 +52,8 @@ buildNpmPackage {
   # See `./frontend.nix`'s comment on the same line.
   npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
+  nativeBuildInputs = [ librsvg ];
+
   buildPhase = ''
     runHook preBuild
     npm run build --workspace=packages/swarm-ui
@@ -51,6 +66,18 @@ buildNpmPackage {
     mkdir -p $out
     cp -r packages/swarm-ui/dist/. $out/
     cp ${branding-svg} $out/favicon.svg
+    rsvg-convert -w 192 -h 192 ${branding-svg} -o $out/icon-192.png
+    rsvg-convert -w 512 -h 512 ${branding-svg} -o $out/icon-512.png
+
+    # `branding-svg-maskable` embeds `branding-svg` via a relative
+    # `<image>` reference (see that file's own comment) — each is passed
+    # in as its own single-file store path, so the sibling reference
+    # only resolves once both live together in one directory again.
+    mkdir -p "$TMPDIR/branding"
+    cp ${branding-svg} "$TMPDIR/branding/hyperhive.svg"
+    cp ${branding-svg-maskable} "$TMPDIR/branding/hyperhive-maskable.svg"
+    rsvg-convert -w 512 -h 512 "$TMPDIR/branding/hyperhive-maskable.svg" \
+      -o $out/icon-512-maskable.png
     runHook postInstall
   '';