webclient: PWA hardening — stable height skeleton, touch selection policy, fixed maskable icons ...

- html/body/#app height via percentages instead of 100vh/dvh: the standalone
  PWA visual viewport drifts with keyboard/system panels, which let the
  document exceed the screen and scroll fixed headers away.
- viewport meta gains interactive-widget=resizes-content; phone-width inputs
  (textarea/text) are pinned to 16px to avoid mobile focus zoom.
- Selection policy: service chrome (chat header, sidebar, tab strip, input
  bar, meta rows) is unselectable with -webkit-touch-callout, killing the
  'Search with Google' sheet on long-press; message content and settings
  panels keep selectable text.
- Apple touch icon switched to a proper 180px tile.
- Regenerated maskable icons (were degenerate 1px-tall files): dark
  background plus the logo inside the 80% safe zone.
- manifest gains display_override.

webclient: artifacts panel — compact actions, refresh in static row, file icons via phosphor 2.x ...

- artifact-actions: flex wrap gap 4px instead of full-width stretched grid
- files refresh: static toolbar row (GnIconButton sm) instead of floating
  absolute button that sat on top of the first list rows
- file icons: phosphor vendored 1.4.2 lacked the file-type glyphs
  (py/ts/js/html/css...) that fileIcon() already mapped — upgrade to
  @phosphor-icons/web 2.1.2 (bundled regular font), drop the vendor dir;
  json -> file-code (phosphor has no json glyph)

PWA: installable webclient, offline shell, web push ...

Installability:
- public/manifest.webmanifest (standalone, theme #16161E) + PNG icons
  generated from logo.svg (regular + maskable, served via /images mount)
- index.html: manifest link, theme-color, apple-touch-icon

Offline shell:
- hand-rolled sw.js (no workbox): navigation = network-first (3s race)
  with cached-shell fallback + background refresh (a stale cached shell
  would 404 on entry chunks after a deploy); /assets/* cache-first
  (content-hashed); /images/* cache-first capped; /api,/ws,/auth,/push,
  /content pass-through
- vite closeBundle plugin stamps __NAVI_BUILD_VERSION__ (digest of
  index.html + asset names) into dist/sw.js; sw.js served no-store so
  every deploy reactivates the SW and activation evicts old caches
- SW registration in main.js, PROD only (dev HMR untouched)
- OfflineBanner (useOnline composable) over the app shell

Web push (VAPID, pywebpush):
- navi/push/ package: push_subscriptions table (postgres, boot-time DDL),
  PushSubscriptionStore, PushService (async fan-out, to_thread sends,
  404/410 prunes dead endpoints, per-session cooldown)
- routes: GET /push/vapid-key, POST/DELETE /push/subscribe (auth-gated)
- trigger in orchestrator run_agent + run_recall: push on StreamEnd when
  no WebSocket client watches the session; fire-and-forget, never
  disturbs the run; anonymous fallback only when auth is off
- client: usePush composable + Notifications settings panel (enable/
  disable via PushManager.subscribe with the server VAPID key)
- notification click focuses the app at /#<session_id> (hash routing
  opens the right chat); payload body is a markdown-stripped <=140-char
  preview

NAVIVAPID keys empty = push fully disabled (graceful, like other optional
integrations). dist/ artifacts committed per repo convention.

Tests: pytest push store/service/routes/trigger (+23), vitest usePush
(83 webclient tests green). Full suite 1143 passed.

Add artifact source previews

Migrate to Vue webclient; rename old client to old_webclient ...

- client/ → old_webclient/ (vanilla JS client preserved as reference)
- webclient/ — new Vue 3 + Pinia webclient (source + dist build)
- vite.config.js: outDir changed to webclient/dist/
- main.py: serve /assets and /images from webclient/dist/,
  index.html from webclient/dist/index.html
- .gitignore: exclude webclient/node_modules/, include webclient/dist/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>