chore(offline-sync): tighten SW denylist, drop dead /api cache + http localhost CORS

- Service worker (vite-plugin-pwa/Workbox): add /share/, /mcp, and /robots.txt
  to navigateFallbackDenylist so the SPA app-shell never shadows those
  server-rendered routes (they mirror the server static-serve exclude list — the
  share SEO/OG HTML, the MCP endpoint, and robots.txt must come from the server).
- Remove the dead /api GET NetworkFirst Workbox rule (api-get-cache): offline
  reads are served by the persisted TanStack Query cache (IndexedDB) + y-indexeddb,
  never by an SW HTTP cache, so caching GET /api only risked stale responses. All
  /api is now NetworkOnly. clearOfflineCache still deletes any legacy api-get-cache
  defensively (comment updated to note it is no longer created).
- CORS: drop the cleartext 'http://localhost' native-WebView origin. The Capacitor
  shell uses the secure scheme (capacitor.config cleartext:false, default Android
  scheme https, iOS hosted via CAP_SERVER_URL), so no native client uses it;
  allowing it only widened the credentialed-CORS surface. Keeps capacitor://,
  ionic://, and https://localhost.
- docs/mobile-bootstrap.md: replace the inaccurate 'hand-rolled service worker'
  description with the real Workbox generateSW setup (prompt registration via
  virtual:pwa-register, production-only, denylist, NetworkOnly, RQ/y-indexeddb
  offline reads) and drop http://localhost from the CORS origins list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/src/integrations/environment/cors.util.ts

@@ -5,12 +5,23 @@
 // allowlist (apart from no-Origin requests) is rejected.
 
 // Native WebView origins used by the Capacitor/Ionic mobile shell. Always
-// trusted so the native client can call the API. CORS hardening of these is
-// intentionally out of scope.
+// trusted so the native client can call the API.
+//
+//   - `capacitor://localhost` — iOS native custom scheme.
+//   - `ionic://localhost`     — legacy native custom scheme.
+//   - `https://localhost`     — Android default secure scheme.
+//
+// The cleartext `http://localhost` origin is intentionally NOT trusted: the
+// Capacitor shell uses the secure scheme (capacitor.config.ts sets
+// `cleartext: false` and does not override `androidScheme`, so Capacitor's
+// default Android scheme is `https` => origin `https://localhost`), and iOS runs
+// in hosted mode (`server.url` = CAP_SERVER_URL, whose origin is the app URL
+// already in the allowlist). No native client legitimately uses
+// `http://localhost`, so allowing it would only widen the credentialed-CORS
+// surface to arbitrary local http content.
 const NATIVE_WEBVIEW_ORIGINS = [
   'capacitor://localhost',
   'ionic://localhost',
-  'http://localhost',
   'https://localhost',
 ] as const;