fix: close the review findings on the restore-all/deep-links/PWA wave

Two reviewers, no blockers, two majors — all fixed.

- The remembered-tab focus after a Restore-all batch fired at the
  message boundary, but the LAST restore's tab inserts one async round
  later (its OPFS recent-cache write precedes the insertion) and the
  insertion's own activation overwrote the selection. The focus flag
  now also consumes at the insertion point, so the batch focus holds
  in the common all-success case.
- The service worker cached ANY successful in-scope navigation under
  the shell key — a direct navigation to a font or JSON would be
  served as the app shell for every offline navigation until the next
  online visit. Only the scope root caches as the shell now.

Also: '/app/' gets its own web app manifest (the previous commit's
'installable' claim was true only of the marketing site, whose
start_url sits OUTSIDE the service worker's scope — an installed app
opened offline showed an error page). Its icon is the
existing assets/logo.svg, copied next to the page.

(cherry picked from commit 369e2c8b)

Ported onto main (#1717 review): the build-web.sh and README hunks stay
out with the wrapper.

web/app.webmanifest

@@ -0,0 +1,18 @@
+{
+  "name": "Open CAD Studio",
+  "short_name": "OCS",
+  "description": "A free CAD editor for DWG and DXF drawings.",
+  "start_url": "./",
+  "scope": "./",
+  "display": "standalone",
+  "background_color": "#1e1e1e",
+  "theme_color": "#1e1e1e",
+  "icons": [
+    {
+      "src": "logo.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    }
+  ]
+}

web/sw.js

@@ -89,9 +89,13 @@ self.addEventListener("fetch", (event) => {
     event.respondWith(
       (async () => {
         const cache = await caches.open(CACHE_NAME);
+        // Only the scope root is the app shell: caching any other in-scope
+        // navigation here would store e.g. a font or JSON body under the
+        // shell key and serve it for every offline navigation.
+        const isShell = new URL(request.url).pathname === SHELL_URL.pathname;
         try {
           const fresh = await fetch(request);
-          await put(cache, SHELL_URL, fresh);
+          if (isShell) await put(cache, SHELL_URL, fresh);
           return fresh;
         } catch {
           const cached = await cache.match(SHELL_URL);