feat(pwa): prompt before applying a new version (issue #42)

[tibroc]

Closes the second half of #42 (the install hint shipped earlier). Implements
docs/specs/pwa-update-notification.md — that spec file lives on the branch of
PR #93 and isn't on main yet, so it isn't part of this diff.

What changed

• registerType: 'autoUpdate' → 'prompt'. A new deploy's worker installs and
  waits; nothing reloads on its own.
• UpdateNotice (mounted once in DashboardShell) owns registration via
  useRegisterSW and shows a calm, bottom-left role="status" notice —
  "Neue Version verfügbar." + Neu laden + a dismiss ×. main.tsx no longer
  registers the worker itself (comment there points at the new owner).
• Long-lived clients get told: registration.update() every 60 min (a
  constant, not config) and on every visibilitychange → visible.
• Dismissal is page-load-scoped — nothing persisted, and a later update
  re-shows the notice.
• Tokens only, no new hex; the entry animation is a CSS class so the global
  prefers-reduced-motion reset neutralises it. 44px targets at phone widths,
  compact sizes above the md: breakpoint.
• The notice reserves an 88px bottom-right corner at every width so it can never
  cover the assistant launcher; asserted in e2e.
• Docs: docs/02 §11.1 rewritten (the auth-safe caching block is untouched), one
  README line under Deployment → Notes.

The e2e seam

window.dispatchEvent(new CustomEvent('wolke:sw-need-refresh')) shows the same
notice. Playwright can't produce a second worker version against one embedded
binary, so this is how the viewport suite sees the real component in the real
layout. It's honest production code: with no worker waiting, Reload falls back
to location.reload().

Tests

• Vitest (UpdateNotice.test.tsx, pwa-update.test.ts): hidden by default;
  shown on needRefresh; Reload calls updateServiceWorker(true); dismiss hides
  without touching storage; re-shows on the next update; both locales; axe clean;
  the seam and its plain-reload fallback; polling interval, visibility check,
  teardown, and a rejected check. Mutation-checked (forcing the component to
  render nothing fails 7 of them).
• Playwright (e2e/update-notice.spec.ts, 3 tests × all six viewports):
  appears on trigger, expectViewportHealthy in the open state, doesn't
  overlap the top-bar nav or the launcher corner, dismiss restores a clean
  layout.

Gates: tsc --noEmit (app + e2e), vitest run 238 passed, make e2e 133
passed / 6 skipped, go test -race ./... clean, embedded build green.
internal/web/dist is untracked and stayed that way.

The first push failed CI's npm run lint on react-hooks/set-state-in-effect:
the notice cleared its dismissal from an effect watching needRefresh. (I first
misread that as a pre-existing full-icon.tsx error — git stash had left the
new untracked files in place, so the "unchanged" comparison was worthless.) The
follow-up commit derives it instead: count the updates this page load has heard
about, remember the count a dismissal was made at. Same behaviour, no
render-then-correct pass. Lint is now 0 errors / 8 pre-existing warnings, and
all gates were re-run green after the fix.

Manual verification of the real SW update path (spec §3)

Driven against the embedded binary on :8472 with the real mock IdP session —
build, load, confirm the worker controls the page, then change a user-visible
string, make build, restart the server, and watch the untouched tab.

• Poll path (interval temporarily shortened to 10s): the notice appeared in
  the tab with no interaction; clicking Neu laden swapped
  index-DYB9gIZ6.js → index-DC2lmAju.js and the new build's string was on
  the page. ✅
• Resume path (interval back at the real 60 min, so only a resume can fire):
  after the deploy the tab sat idle with no notice, then a visibilitychange
  produced a waiting worker and the notice; Reload landed
  index-jJWePKAY.js → index-CorI8Yds.js with the new string. ✅

Reported honestly: Playwright never puts a page into the hidden state —
bringToFront fires no visibilitychange, headless or headed, and
Page.setWebLifecycleState doesn't either — so in that second run the browser's
firing of the event was dispatched by the harness. Everything downstream (the
production listener, the real registration, the update fetch over HTTP, the
waiting worker, the notice, the reload) was real. A genuine phone-unlock resume
is the one link not exercised end-to-end here. Chrome DevTools MCP failed to
attach in this environment ("Target closed"), which is why this ran through
Playwright rather than an interactive browser session.

Desktop install UI is still deliberately left to the browser (unchanged from the
install-hint PR).

Left unmerged for supervisor review.

[tibroc]

Supervisor review: approve. Two recorded nits, non-blocking: (1) onRegisteredSW discards startUpdateChecks' teardown, so a DashboardShell remount would leak the hourly interval — latent since the shell mounts once per page load; (2) after dismissing a real update, a later deploy in the same tab doesn't re-show the notice (needRefresh is already true; only the seam increments the count) — benign, but the dismissal comment claims otherwise. Fine to fix opportunistically later.