feat(app): add PWA shortcuts and Quick Capture

[ctwhome]

Summary

• Makes HUE an installable PWA with stable identity/scope, standalone chrome, maskable high-contrast icons, service worker, and prioritized launcher shortcuts.
• Adds explicit launch precedence for Project/Session links, New Session, Quick Idea, Projects, Recents, share intake, future notification links, remembered state, and safe defaults.
• Adds a focused Quick Capture flow that preserves unsent local drafts, lets the user select a Hermes Project or projectless Session, and never creates/sends without explicit action.
• Adds a bounded Web Share Target with same-origin enforcement, MIME/signature/name/size validation, one-time five-minute tokens, strict global retained-byte budget, and no private content in URLs/cookies/logs/permanent storage.
• Adds user-gesture-only install guidance and honest copy/share/browser-menu fallback for per-Project/Session pinning; no fake dynamic PWA shortcut claims.
• Caches versioned immutable build assets only—never navigation, API, Session, transcript, or other private workspace responses.

Verification

• bun test — 352 passed, 4 opt-in integrations skipped
• bun run --cwd app check — 0 errors, 0 warnings
• production build + service-worker build — passed
• canonical production bun run start E2E — 53 passed
• share Origin/parser/body-budget, one-time/TTL/concurrency/release, icon color, install failure feedback, launch precedence, Quick Capture, mobile 320/390 and existing workspace tests — passed
• Lighthouse: performance 93, accessibility 94, best practices 100, SEO 100
• Chrome CDP: zero manifest errors, zero installability errors
• changed-file Prettier and git diff --check — passed
• final independent code review — CLEAN after repairs

Stack and device evidence

• Depends on feat(app): add native mobile navigation #87 (feat/mobile-gestures-resume); merge feat(app): add native mobile navigation #87 first, then retarget this PR to main and reverify.
• Automated browser evidence proves installability/manifest/share contracts. Physical Android standalone launch, long-press shortcut order, and OS share-sheet behavior remain honest device checks and are not claimed here; the Android environment is completed in Android native shell for widgets and dynamic Project shortcuts #86.

Closes #85