feat(web): add network-only PWA installability

[korsun009]

Summary

Adds network-only PWA installability to the panel without introducing offline caching.

• serves a web app manifest, registration script, service worker, and icons under the configured runtime webBasePath
• injects manifest and registration links into the login and panel pages
• allowlists the embedded PWA assets with explicit content types and no-cache headers
• adds controller tests and documentation for dynamic base paths and verification

Why

Android browsers currently treat the panel as a regular website and may only offer a shortcut. Providing the minimal PWA surface allows installation as a standalone app while preserving the panel's existing network-only behavior and arbitrary secret base paths.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Documentation
• Tests only
• Build / CI / tooling
• Other

Areas affected

• Frontend (UI / panel pages)
• Backend (API endpoints, login, settings)
• Xray config generation
• Subscription (share links / Clash / JSON)
• Statistics / traffic counters
• Database / migrations
• Install / upgrade script
• Docker image
• Multi-node (sub-nodes)
• Telegram bot

How was this tested?

• go test -count=1 ./...
• go vet ./...
• go build ./...
• npm run typecheck
• npm run lint
• npm run test on Linux with Node 24 and headless Chromium
• npm run build
• npm run build-storybook
• Playwright smoke test confirmed that a non-root runtime base path registers the service worker with the matching scope
• Deployed verification confirmed the same build serves the PWA assets correctly on two panels with different runtime base paths

Screenshots / recordings

N/A. This change adds browser installability metadata and does not alter the visible panel UI.

Breaking changes

None. Existing authentication, APIs, database state, Xray configuration, and network behavior are unchanged.

Checklist

• I tested the change locally and confirmed the described behavior.
• I added or updated tests for the new behavior (when applicable).
• go build ./... and the test suite pass locally.
• For frontend changes: npm run lint, npm run typecheck, and npm run build pass.
• I updated the Wiki / README / API docs if user-facing behavior changed.
• My commits follow the project's existing message style.
• I have no unrelated changes mixed into this PR.