Phase 3: PWA offline caching (frontend only)

Adds a real Workbox runtime-caching strategy on top of the Phase 1 app-shell
precache: StaleWhileRevalidate (cache-and-refresh) for the five read
endpoints (rooms/mine, open rooms, room messages, room members, invites/mine)
with a bounded/expiring cache per endpoint, while /api/auth/* and all
mutations stay network-only. An OfflineBanner (navigator.onLine-driven) and
a clearer Composer status line ("Connecting..." vs "You're offline") surface
what's actually happening; api/client.ts gains a NetworkError distinct from
ApiError so a genuine cache-miss-while-offline shows a quiet empty state
instead of a red error.

Manual offline testing (backend stopped, `vite preview` against the real
production service worker) surfaced a real gap the plan hadn't accounted
for: GET /api/auth/me is intentionally NetworkOnly, but that meant
ProtectedRoute could never confirm a session while offline and always
bounced to /login -- none of the newly-cached room/message data was ever
reachable. Fixed by caching a minimal, non-sensitive "last known user" in
localStorage (lib/lastUser.ts) and having AuthContext fall back to it for
any *unconfirmed* auth check (network failure, or a down backend answering
through a live reverse proxy with its own 502/503/504 -- both happen in
real deployments, not just literal airplane-mode). Only a server-confirmed
401 still clears it and signs the user out; every real action still
re-checks the actual session cookie server-side, so this can't grant
anything -- it only keeps cached UI reachable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -2,6 +2,11 @@ import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 import { VitePWA } from 'vite-plugin-pwa'
 
+const READ_CACHE_EXPIRATION = {
+  maxEntries: 50,
+  maxAgeSeconds: 7 * 24 * 60 * 60, // 7 days
+}
+
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [
@@ -13,8 +18,8 @@ export default defineConfig({
         short_name: 'Talking',
         start_url: '/',
         display: 'standalone',
-        background_color: '#ffffff',
-        theme_color: '#111111',
+        background_color: '#07080f', // --ds-void
+        theme_color: '#101030', // --ds-surface
         icons: [
           { src: '/icons/icon-192.png', sizes: '192x192', type: 'image/png' },
           { src: '/icons/icon-512.png', sizes: '512x512', type: 'image/png' },
@@ -28,9 +33,71 @@ export default defineConfig({
       },
       workbox: {
         navigateFallbackDenylist: [/^\/api/, /^\/ws/],
+        // urlPattern uses function matchers against url.pathname rather than
+        // RegExp (which Workbox tests against the *full href*, origin
+        // included -- a `^/api/` anchor would silently never match).
         runtimeCaching: [
+          // Never serve a stale cached "who am I" response.
           {
-            urlPattern: /^\/api\//,
+            urlPattern: ({ url }) => url.pathname.startsWith('/api/auth/'),
+            handler: 'NetworkOnly',
+          },
+          // Cache-and-refresh: show the last known list/history immediately,
+          // update from the network in the background. Routes default to
+          // matching GET only, so mutations to these same paths are
+          // untouched and still go straight to network.
+          {
+            urlPattern: ({ url }) => url.pathname === '/api/rooms/mine',
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'api-rooms-mine',
+              expiration: READ_CACHE_EXPIRATION,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            urlPattern: ({ url }) => url.pathname === '/api/rooms',
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'api-rooms-open',
+              expiration: READ_CACHE_EXPIRATION,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            urlPattern: ({ url }) =>
+              /^\/api\/rooms\/[^/]+\/messages$/.test(url.pathname),
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'api-room-messages',
+              expiration: READ_CACHE_EXPIRATION,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            urlPattern: ({ url }) =>
+              /^\/api\/rooms\/[^/]+\/members$/.test(url.pathname),
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'api-room-members',
+              expiration: READ_CACHE_EXPIRATION,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          {
+            urlPattern: ({ url }) => url.pathname === '/api/invites/mine',
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'api-invites-mine',
+              expiration: READ_CACHE_EXPIRATION,
+              cacheableResponse: { statuses: [0, 200] },
+            },
+          },
+          // Defensive default: anything else under /api/ (including any
+          // future GET endpoint) stays network-only until explicitly opted
+          // in above.
+          {
+            urlPattern: ({ url }) => url.pathname.startsWith('/api/'),
             handler: 'NetworkOnly',
           },
         ],
@@ -49,4 +116,19 @@ export default defineConfig({
       },
     },
   },
+  // `vite preview` doesn't inherit `server.proxy` -- needed to exercise the
+  // real production service worker (only registered against a built
+  // bundle, not `vite dev`) against the actual backend.
+  preview: {
+    proxy: {
+      '/api': {
+        target: 'http://localhost:8000',
+        changeOrigin: true,
+      },
+      '/ws': {
+        target: 'ws://localhost:8000',
+        ws: true,
+      },
+    },
+  },
 })