feat: phase 5 distribution — tauri shell, pwa, desktop release artifacts

- apps/desktop: Tauri 2 thin shell; connect screen stores the deployment
  URL, webview renders the remote console, tray with Show/Change Server/
  Quit, close-to-tray, single-instance
- frontend: vite-plugin-pwa generates manifest + Workbox SW (shell
  precache, /api /auth /mailpit NetworkOnly), install banner on
  beforeinstallprompt, rasterized PWA icons
- release.yml: desktop bundle matrix (linux/macos/windows) attached to
  GitHub Releases
- workspace 0.5.0; Dockerfiles copy the desktop workspace manifest

Authored By: TDvorak <[email protected]>

apps/frontend/vite.config.ts

@@ -1,8 +1,56 @@
 import { defineConfig } from "vite";
 import solidPlugin from "vite-plugin-solid";
+import { VitePWA } from "vite-plugin-pwa";
 
 export default defineConfig({
-  plugins: [solidPlugin()],
+  plugins: [
+    solidPlugin(),
+    VitePWA({
+      registerType: "autoUpdate",
+      injectRegister: "auto",
+      manifest: {
+        name: "Primora",
+        short_name: "Primora",
+        description:
+          "Self-hosted backend console: storage, collections, API keys, audit logs.",
+        theme_color: "#0b0d11",
+        background_color: "#0b0d11",
+        display: "standalone",
+        start_url: "/",
+        icons: [
+          { src: "pwa-192x192.png", sizes: "192x192", type: "image/png" },
+          { src: "pwa-512x512.png", sizes: "512x512", type: "image/png" },
+          {
+            src: "maskable-512x512.png",
+            sizes: "512x512",
+            type: "image/png",
+            purpose: "maskable",
+          },
+        ],
+      },
+      workbox: {
+        // Cache the app shell only. /api, /auth and /mailpit are live backends —
+        // never let a service worker answer for them.
+        navigateFallback: "/index.html",
+        navigateFallbackDenylist: [/^\/(api|auth|mailpit)(\/|$)/],
+        runtimeCaching: [
+          {
+            urlPattern: /\/(api|auth|mailpit)(\/|$)/,
+            handler: "NetworkOnly",
+          },
+          {
+            // Geist font files + CSS from Google Fonts — long-lived static assets.
+            urlPattern: /^https:\/\/fonts\.(googleapis|gstatic)\.com\//,
+            handler: "CacheFirst",
+            options: {
+              cacheName: "primora-fonts",
+              expiration: { maxEntries: 20, maxAgeSeconds: 60 * 60 * 24 * 365 },
+            },
+          },
+        ],
+      },
+    }),
+  ],
   server: {
     host: "0.0.0.0",
     port: Number(process.env.FRONTEND_PORT ?? 3000),
@@ -15,4 +63,3 @@ export default defineConfig({
     target: "esnext",
   },
 });
-