feat(web): add installable dashboard metadata

[seagpt]

What

Adds focused installability metadata for the dashboard so the Hermes web UI can be saved/launched as a standalone browser app on desktop and mobile devices:

• adds manifest.webmanifest
• adds 192px and 512px PNG app icons
• adds browser/mobile metadata in web/index.html
• keeps manifest start_url, scope, and icon paths relative so installs work under a path-prefix reverse proxy/VPN URL
• extends SPA prefix rewriting for root-absolute manifest/icon links in served index.html
• adds JS and Python regression tests for metadata presence and X-Forwarded-Prefix safety

Related Issue

No issue. Follow-up from dashboard/desktop-as-webapp QA.

Related / overlap checked:

• feat(dashboard): installable PWA + fix Skills row overflow on mobile #58532 also adds installable PWA metadata, but is broader (Skills row overflow + PWA). This PR is intentionally smaller and adds explicit path-prefix/VPN proxy coverage.
• feat(dashboard): PWA support (installable, standalone mode) #9897 also targets standalone dashboard PWA support.
• feat(web): mobile-first chat — native UI, voice dictation, installable PWA #50140 includes PWA work as part of a much larger mobile-first chat change.

Type of Change

• Bug fix
• New feature
• Refactor
• Tests
• Documentation

Verification

• npm --workspace web run test -- src/lib/pwa-metadata.test.ts
• npm --workspace web exec eslint -- src/lib/pwa-metadata.test.ts --max-warnings=0
• npm --workspace web run typecheck
• npm --workspace web run build
• python -m py_compile hermes_cli/web_server.py
• uv run --with pytest --with httpx --with starlette --with fastapi pytest -q tests/hermes_cli/test_web_server_spa_pwa_prefix.py
• python scripts/check-windows-footguns.py $(git diff --cached --name-only) before commit
• git diff --cached --check before commit
• diff-only secret scan: 0 hits
• visual check of generated 512px icon

Checklist

• I searched existing open/closed PRs/issues for duplicates or overlap and noted related PRs above.
• I added or updated tests for the changed behavior.
• I verified the real build output includes manifest.webmanifest, icon-192.png, icon-512.png, and the metadata in built index.html.
• I considered path-prefixed/VPN deployments and added a regression test for X-Forwarded-Prefix.
• No secrets or credentials are included.
• No user-facing env var was added.
• Docs/config/tool-schema changes are not required for this focused metadata-only change.

[teknium1]

Thanks for the focused PWA metadata and prefix-aware coverage. Current main has no dashboard manifest or install icons, and the changes extend the existing prefix rewrite in hermes_cli/web_server.py:15695-15704 cleanly.

Problems

• web/index.html:8 adds a root-level manifest, but the OAuth gate's public static allowlist in hermes_cli/dashboard_auth/middleware.py:43-55 does not include the manifest or either new icon. With auth_required, requests outside the allowlist enter the cookie gate at middleware.py:274-290. The new server test sets auth_required = False, so it does not cover that deployment mode. This overlaps the static-asset issue described in related PR #58532.

Suggested changes

• Allowlist /manifest.webmanifest, /icon-192.png, and /icon-512.png, and add a gated regression test that fetches them without a session cookie.

Automated hermes-sweeper review.

[teknium1]

For OAuth-gated dashboards, this root-level manifest (and the two new root-level icons) is not in _GATE_PUBLIC_PREFIXES at hermes_cli/dashboard_auth/middleware.py:43-55; unauthenticated static requests enter the cookie gate. Please allowlist these three paths and add a gated regression test.