fix(phase 3j auth): allow /static/* through auth middleware for PWA install

The manifest + icons + sw.js need to be reachable pre-auth so the iOS
'Add to Home Screen' flow can fetch the manifest from the /login page
(the browser fetches install metadata BEFORE the user signs in). Static
assets are embedded, non-sensitive, no leakage risk.

web/auth.go

@@ -95,6 +95,14 @@ func authMiddleware(cfg AuthConfig, logger *slog.Logger, next http.Handler) http
 			next.ServeHTTP(w, r)
 			return
 		}
+		// /static/* must be reachable pre-auth so the PWA install flow works
+		// on the login page (browser fetches the manifest + icon BEFORE the
+		// user signs in, so the "Add to Home Screen" affordance can render).
+		// These are non-sensitive embedded assets — no leakage risk.
+		if strings.HasPrefix(r.URL.Path, "/static/") {
+			next.ServeHTTP(w, r)
+			return
+		}
 
 		access := tokenFromBearer(r)
 		if access == "" {