refactor: simplify PWA handlers and fix review findings

Address code review findings from reuse, quality, and efficiency agents:

- Cache manifest JSON and service worker JS at init (was rebuilt per
  request with allocations and JSON encoding on every hit)
- Add ImagePathsByUser store method for targeted image cleanup (was
  loading 100k full fave objects just to read image_path)
- Add missing aria-label on privacy toggle in fave_list.html (inline
  copy had drifted from the partial — accessibility bug)
- Fix comment/function name mismatch in pwa.go
- Remove redundant user nil-check in handleShare (requireLogin guards)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handler/handler.go

@@ -32,14 +32,20 @@ type Deps struct {
 type Handler struct {
 	deps        Deps
 	rateLimiter *middleware.RateLimiter
+
+	// Cached PWA responses (computed once at init, never change).
+	manifestJSON []byte
+	swJS         []byte
 }
 
 // New creates a new Handler with the given dependencies.
 func New(deps Deps) *Handler {
-	return &Handler{
+	h := &Handler{
 		deps:        deps,
 		rateLimiter: middleware.NewRateLimiter(deps.Config.RateLimit),
 	}
+	h.initPWACache()
+	return h
 }
 
 // RateLimiterCleanupLoop periodically evicts stale rate limiter entries.