feat: add PWA support (manifest, service worker, icons)

Adds vite-plugin-pwa with a generated manifest, icon set derived from
the Stalwart mark (192/512/maskable/apple-touch), and theme-color meta
tags. /api and /jmap are excluded from the service worker's navigate
fallback and are never precached or runtime-cached, so authenticated
mail data can't end up in Cache Storage.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

vite.config.ts

@@ -1,6 +1,7 @@
 import { defineConfig } from 'vitest/config'
 import react from '@vitejs/plugin-react'
 import tailwindcss from '@tailwindcss/vite'
+import { VitePWA } from 'vite-plugin-pwa'
 import path from 'path'
 import { version } from './package.json'
 
@@ -9,7 +10,35 @@ export default defineConfig({
   define: {
     __APP_VERSION__: JSON.stringify(version),
   },
-  plugins: [react(), tailwindcss()],
+  plugins: [
+    react(),
+    tailwindcss(),
+    VitePWA({
+      registerType: 'autoUpdate',
+      includeAssets: ['favicon.ico'],
+      manifest: {
+        name: 'Stalwart WebUI',
+        short_name: 'Stalwart',
+        description: 'Administration panel for Stalwart Mail Server',
+        start_url: '/',
+        scope: '/',
+        display: 'standalone',
+        theme_color: '#db2d54',
+        background_color: '#ffffff',
+        icons: [
+          { src: 'pwa/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
+          { src: 'pwa/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any' },
+          { src: 'pwa/maskable-512.png', sizes: '512x512', type: 'image/png', purpose: 'maskable' },
+        ],
+      },
+      workbox: {
+        // /api and /jmap serve authenticated mail data: never precache or
+        // runtime-cache them, always hit the network so an installed PWA
+        // can't show stale or cross-account data from a previous session.
+        navigateFallbackDenylist: [/^\/api/, /^\/jmap/],
+      },
+    }),
+  ],
   resolve: {
     alias: {
       '@': path.resolve(__dirname, './src'),