feat: add PWA support with Android share intent

Make Favoritter installable as a Progressive Web App with offline
static asset caching and Web Share Target API for Android.

New files:
- internal/handler/pwa.go: handlers for manifest, service worker,
  and share target
- web/static/sw.js: service worker (cache-first static, network-first
  HTML) with {{BASE_PATH}} placeholder for subpath deployments
- web/static/icons/: placeholder PWA icons (192, 512, 512-maskable)

Key design decisions:
- Share target uses GET (not POST) to avoid CSRF token issues — Android
  apps cannot provide CSRF tokens
- Manifest is generated dynamically to inject BasePath into start_url,
  scope, icon paths, and share_target action
- Service worker served at /sw.js with Cache-Control: no-cache and
  BasePath injected via string replacement
- handleShare extracts URLs from Android's "text" field as fallback
  (many apps put the URL there instead of "url")
- handleFaveNew replaced with handleFaveNewPreFill that reads url,
  description, notes from query params (enables share + bookmarklets)
- SW registration in app.js reads base-path from <meta> tag (CSP-safe)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handler/handler.go

@@ -74,6 +74,10 @@ func (h *Handler) Routes() *http.ServeMux {
 	// Health check.
 	mux.HandleFunc("GET /health", h.handleHealth)
 
+	// PWA: manifest and service worker (public, no auth).
+	mux.HandleFunc("GET /manifest.json", h.handleManifest)
+	mux.HandleFunc("GET /sw.js", h.handleServiceWorker)
+
 	// Auth routes (rate-limited).
 	mux.Handle("POST /login", h.rateLimiter.Limit(http.HandlerFunc(h.handleLoginPost)))
 	mux.Handle("POST /signup", h.rateLimiter.Limit(http.HandlerFunc(h.handleSignupPost)))
@@ -91,8 +95,9 @@ func (h *Handler) Routes() *http.ServeMux {
 
 	// Faves — authenticated routes use requireLogin wrapper.
 	requireLogin := middleware.RequireLogin(h.deps.Config.BasePath)
+	mux.Handle("GET /share", requireLogin(http.HandlerFunc(h.handleShare)))
 	mux.Handle("GET /faves", requireLogin(http.HandlerFunc(h.handleFaveList)))
-	mux.Handle("GET /faves/new", requireLogin(http.HandlerFunc(h.handleFaveNew)))
+	mux.Handle("GET /faves/new", requireLogin(http.HandlerFunc(h.handleFaveNewPreFill)))
 	mux.Handle("POST /faves", requireLogin(http.HandlerFunc(h.handleFaveCreate)))
 	mux.HandleFunc("GET /faves/{id}", h.handleFaveDetail)
 	mux.Handle("GET /faves/{id}/edit", requireLogin(http.HandlerFunc(h.handleFaveEdit)))