fix(pwa): restore installability lost in the Next.js migration - #235

CI ran CodeQL, Semgrep, npm-audit and gitleaks but never vitest, so nobody
noticed the suite could not start at all: vitest.config.js failed to load
because @vitejs/plugin-react@6 peers vite ^8 while vitest 4 ships vite 7. That
was fixed in #235; this wires the suite into CI so it stays runnable.

Triaging all 139 test files in isolation gave 72 passing, 66 failing and 1
hanging. Two mechanical problems accounted for a third of the breakage:

- 24 files did `import { describe, it } from 'mocha'` while the repo runs
  vitest, so those bindings were undefined and the file died on
  "Cannot read properties of undefined (reading 'describe')". Removed the
  import (vitest already sets globals: true) and renamed mocha's before/after
  to vitest's beforeAll/afterAll.
- jsdom ships no IndexedDB, but the app stores private keys there, so every
  test touching key storage hit "indexedDB is not defined". tests/setup.js now
  imports fake-indexeddb/auto.

That took it to 80 passing / 58 failing / 1 hanging. The remaining 59 are listed
in tests/quarantine.js and excluded from the default suite: 19 have genuinely
failing assertions, 13 import SvelteKit paths the migration deleted, 12 need a
live Supabase, 5 use undefined globals, 1 has a parse error, 9 are assorted.
tests/pwa-session-integration.test.js hangs rather than fails, which is what
made `pnpm test` unusable.

They are quarantined rather than deleted because each still documents intended
behaviour worth porting, and a permanently red build gets ignored. Work them off
with `pnpm test:quarantined`; deleting a line from the list is how a file
rejoins CI. tests/QUARANTINE.md explains the categories and the fix for each.

CI now runs `pnpm test:ci`: 80 files, 469 tests, ~33s, green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(icons): point the icon pipeline at public/, not static/

`pnpm icons:generate` wrote into `static/icons` and `pnpm icons:install` read
from there, but Next only serves `public/`. Regenerating icons updated a tree
nobody serves while the served one silently went stale — which is how the two
directories drifted apart in the first place.

- generate-icons.js reads ./public/favicon.svg and writes ./public/icons.
- It now emits every icon the app references, not a subset: the android-chrome-*
  family (which is what public/manifest.json actually points at), the favicon-NxN
  set, and the Windows mstile tiles including the non-square 310x150. Previously
  regenerating refreshed the apple-touch icons and four icon-* sizes while
  leaving the icons Chromium installs with untouched.
- install-desktop-icons.sh copies from public/. Its 16px and 32px fallbacks
  looked for static/favicon-{16,32}.png, which never existed, so both branches
  were dead; they now use public/icons/favicon-{16x16,32x32}.png.
- Dropped the `needsSolidBackground` branch. `background` only paints the
  letterbox that `fit: 'contain'` adds, and favicon.svg is square, so it painted
  nothing — the committed icons have always had transparent pixels. Making the
  manifest's maskable 192/512 icons genuinely opaque needs `.flatten()` plus
  safe-zone padding, which changes how the installed icon looks, so it is left
  as a deliberate design decision rather than folded in here.

Running the generator now rewrites exactly the 38 PNGs already in public/icons
and creates no new files, so the script and the tree agree. Regenerated binaries
are not committed — this change is tooling only, no icon artwork changes.

tests/pwa-installability.test.js grows five checks tying the generator to the
manifest and layout: every icon either references must be one the generator
emits, and no tooling may point at static/ again. That is what caught the
missing mstile tiles.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: delete the static/ SvelteKit holdover

static/ was a near-exact copy of public/ left behind by the Next.js migration.
Next only serves public/, so every one of these 56 files was dead weight — and
a trap, since editing static/manifest.json looks like it should do something.

Verified before removing: every file under static/ has a counterpart in public/,
including .well-known/security.txt (which prod serves 200). The icon tooling
that genuinely did read static/ was retargeted at public/ in the previous
commit, so nothing references it any more.

Also fixed while here:
- public/qryptchat.desktop hardcoded
  `Icon=/home/ettinger/src/qrypt.chat/qryptochat-web/static/qryptchat.png`, an
  absolute path into a developer's home directory (with a typo in the folder
  name), so the installed desktop launcher had no icon for anyone else. The
  installer registers the icon in the hicolor theme, so the entry just needs the
  theme name: `Icon=qryptchat`.
- PWA_VIDEO_PLAYBACK_GUIDE.md told readers to edit static/manifest.json.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: run vitest, with the broken tests quarantined

CI ran CodeQL, Semgrep, npm-audit and gitleaks but never vitest, so nobody
noticed the suite could not start at all: vitest.config.js failed to load
because @vitejs/plugin-react@6 peers vite ^8 while vitest 4 ships vite 7. That
was fixed in #235; this wires the suite into CI so it stays runnable.

Triaging all 139 test files in isolation gave 72 passing, 66 failing and 1
hanging. Two mechanical problems accounted for a third of the breakage:

- 24 files did `import { describe, it } from 'mocha'` while the repo runs
  vitest, so those bindings were undefined and the file died on
  "Cannot read properties of undefined (reading 'describe')". Removed the
  import (vitest already sets globals: true) and renamed mocha's before/after
  to vitest's beforeAll/afterAll.
- jsdom ships no IndexedDB, but the app stores private keys there, so every
  test touching key storage hit "indexedDB is not defined". tests/setup.js now
  imports fake-indexeddb/auto.

That took it to 80 passing / 58 failing / 1 hanging. The remaining 59 are listed
in tests/quarantine.js and excluded from the default suite: 19 have genuinely
failing assertions, 13 import SvelteKit paths the migration deleted, 12 need a
live Supabase, 5 use undefined globals, 1 has a parse error, 9 are assorted.
tests/pwa-session-integration.test.js hangs rather than fails, which is what
made `pnpm test` unusable.

They are quarantined rather than deleted because each still documents intended
behaviour worth porting, and a permanently red build gets ignored. Work them off
with `pnpm test:quarantined`; deleting a line from the list is how a file
rejoins CI. tests/QUARANTINE.md explains the categories and the fix for each.

CI now runs `pnpm test:ci`: 80 files, 469 tests, ~33s, green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>