From 179bc83bfe48d7b6f2db102245ff25ccb8fe3a7e Mon Sep 17 00:00:00 2001 From: hermes-explorigin Date: Tue, 8 Sep 2026 13:44:24 +0000 Subject: [PATCH] Add PWA support with a network-sandbox for the installed app Makes the offline-first vault installable as a standalone PWA, and enforces "no network access aside from the app's own resources" once installed. PWA: - public/manifest.webmanifest: scope ./ (confined to the app's own dir), three icons (192/512 + transparent maskable), standalone display, brand theme. No push/shortcuts (deliberate: offline-first vault, nothing to push). - public/sw.js: a NETWORK SANDBOX service worker. Allows only same-origin requests inside the worker's own directory (index, manifest, icons); returns 403 for every cross-origin request and for same-origin paths outside the app dir. This blocks in-app /