Phase 3: PWA offline caching (frontend only)

Adds a real Workbox runtime-caching strategy on top of the Phase 1 app-shell
precache: StaleWhileRevalidate (cache-and-refresh) for the five read
endpoints (rooms/mine, open rooms, room messages, room members, invites/mine)
with a bounded/expiring cache per endpoint, while /api/auth/* and all
mutations stay network-only. An OfflineBanner (navigator.onLine-driven) and
a clearer Composer status line ("Connecting..." vs "You're offline") surface
what's actually happening; api/client.ts gains a NetworkError distinct from
ApiError so a genuine cache-miss-while-offline shows a quiet empty state
instead of a red error.

Manual offline testing (backend stopped, `vite preview` against the real
production service worker) surfaced a real gap the plan hadn't accounted
for: GET /api/auth/me is intentionally NetworkOnly, but that meant
ProtectedRoute could never confirm a session while offline and always
bounced to /login -- none of the newly-cached room/message data was ever
reachable. Fixed by caching a minimal, non-sensitive "last known user" in
localStorage (lib/lastUser.ts) and having AuthContext fall back to it for
any *unconfirmed* auth check (network failure, or a down backend answering
through a live reverse proxy with its own 502/503/504 -- both happen in
real deployments, not just literal airplane-mode). Only a server-confirmed
401 still clears it and signs the user out; every real action still
re-checks the actual session cookie server-side, so this can't grant
anything -- it only keeps cached UI reachable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/Composer.css

@@ -2,12 +2,18 @@
   padding: var(--sp-3) var(--sp-4);
   border-top: 1px solid var(--ds-border);
   background: var(--ds-surface);
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.composer-box {
   display: flex;
   gap: var(--sp-2);
   align-items: flex-end;
 }
 
-.composer textarea {
+.composer-box textarea {
   flex: 1;
   resize: none;
   background: var(--ds-surface-2);
@@ -20,7 +26,7 @@
   max-height: 120px;
 }
 
-.composer textarea:focus {
+.composer-box textarea:focus {
   border-color: var(--ds-accent);
 }
 
@@ -42,3 +48,9 @@
   opacity: 0.5;
   cursor: not-allowed;
 }
+
+.composer-status {
+  font-size: 0.76rem;
+  color: var(--ds-muted);
+  padding-left: 2px;
+}