refactor: simplify PWA handlers and fix review findings

Address code review findings from reuse, quality, and efficiency agents:

- Cache manifest JSON and service worker JS at init (was rebuilt per
  request with allocations and JSON encoding on every hit)
- Add ImagePathsByUser store method for targeted image cleanup (was
  loading 100k full fave objects just to read image_path)
- Add missing aria-label on privacy toggle in fave_list.html (inline
  copy had drifted from the partial — accessibility bug)
- Fix comment/function name mismatch in pwa.go
- Remove redundant user nil-check in handleShare (requireLogin guards)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handler/admin.go

@@ -218,12 +218,10 @@ func (h *Handler) handleAdminDeleteUser(w http.ResponseWriter, r *http.Request)
 	}
 
 	// Delete user's images from disk before database deletion.
-	faves, _, _ := h.deps.Faves.ListByUser(id, 100000, 0)
-	for _, f := range faves {
-		if f.ImagePath != "" {
-			if delErr := image.Delete(h.deps.Config.UploadDir, f.ImagePath); delErr != nil {
-				slog.Error("image delete error", "fave_id", f.ID, "error", delErr)
-			}
+	imagePaths, _ := h.deps.Faves.ImagePathsByUser(id)
+	for _, p := range imagePaths {
+		if delErr := image.Delete(h.deps.Config.UploadDir, p); delErr != nil {
+			slog.Error("image delete error", "error", delErr)
 		}
 	}
 	if user.AvatarPath != "" {