feat: add PWA support with Android share intent

Make Favoritter installable as a Progressive Web App with offline
static asset caching and Web Share Target API for Android.

New files:
- internal/handler/pwa.go: handlers for manifest, service worker,
  and share target
- web/static/sw.js: service worker (cache-first static, network-first
  HTML) with {{BASE_PATH}} placeholder for subpath deployments
- web/static/icons/: placeholder PWA icons (192, 512, 512-maskable)

Key design decisions:
- Share target uses GET (not POST) to avoid CSRF token issues — Android
  apps cannot provide CSRF tokens
- Manifest is generated dynamically to inject BasePath into start_url,
  scope, icon paths, and share_target action
- Service worker served at /sw.js with Cache-Control: no-cache and
  BasePath injected via string replacement
- handleShare extracts URLs from Android's "text" field as fallback
  (many apps put the URL there instead of "url")
- handleFaveNew replaced with handleFaveNewPreFill that reads url,
  description, notes from query params (enables share + bookmarklets)
- SW registration in app.js reads base-path from <meta> tag (CSP-safe)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/static/sw.js

@@ -0,0 +1,66 @@
+// Favoritter — Service Worker for PWA offline support.
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+var BASE = "{{BASE_PATH}}";
+var CACHE_NAME = "favoritter-v1";
+var STATIC_URLS = [
+    BASE + "/static/vendor/pico.min.css",
+    BASE + "/static/vendor/htmx.min.js",
+    BASE + "/static/css/style.css",
+    BASE + "/static/js/app.js",
+    BASE + "/static/icons/icon-192.png"
+];
+
+self.addEventListener("install", function (event) {
+    event.waitUntil(
+        caches.open(CACHE_NAME).then(function (cache) {
+            return cache.addAll(STATIC_URLS);
+        })
+    );
+    self.skipWaiting();
+});
+
+self.addEventListener("activate", function (event) {
+    event.waitUntil(
+        caches.keys().then(function (names) {
+            return Promise.all(
+                names.filter(function (n) { return n !== CACHE_NAME; })
+                    .map(function (n) { return caches.delete(n); })
+            );
+        })
+    );
+    self.clients.claim();
+});
+
+self.addEventListener("fetch", function (event) {
+    var url = new URL(event.request.url);
+
+    // Cache-first for static assets.
+    if (url.pathname.startsWith(BASE + "/static/")) {
+        event.respondWith(
+            caches.match(event.request).then(function (cached) {
+                return cached || fetch(event.request).then(function (response) {
+                    var clone = response.clone();
+                    caches.open(CACHE_NAME).then(function (cache) {
+                        cache.put(event.request, clone);
+                    });
+                    return response;
+                });
+            })
+        );
+        return;
+    }
+
+    // Network-first for navigation (HTML pages).
+    if (event.request.mode === "navigate") {
+        event.respondWith(
+            fetch(event.request).catch(function () {
+                return caches.match(event.request);
+            })
+        );
+        return;
+    }
+
+    // Default: network only.
+    event.respondWith(fetch(event.request));
+});