Add a favicon, home-screen icons and a web manifest

The favicon is a bowl of soup: this household's catalog is half keitto, so it
is at least honest. favicon.svg follows the system theme in the tab strip.

Home-screen icons cannot do the same. They must be opaque and must not change
with the theme, so assets/icon.svg is a separate fixed-colour source, with the
artwork inside the central 80% for Android to mask to any launcher shape. The
same 512 is declared maskable in the manifest.

`make icons` rasterises with rsvg-convert and compresses with
`oxipng -o max --zopfli`, which beat `optipng -o7` at every size — 5860 bytes
against 6109 for the three files. Plain `oxipng -o max` was not an upgrade: it
won the two small icons and lost the 512, ending up larger overall. All output
verified pixel-identical to the rasterizer. The PNGs are committed so the
build needs no rasterizer.

Two things that only fail on a real device, so both are covered by smoke
checks: Go has no mime entry for .webmanifest and served it as octet-stream,
which browsers ignore; and a manifest fetch carries no credentials by default,
so behind Basic auth it needs crossorigin="use-credentials" or it 401s.

Makefile

@@ -3,6 +3,7 @@
 COMPOSE ?= podman compose
 BIN     := foodster
 PKG     := ./cmd/foodster
+STATIC  := cmd/foodster/static
 
 # Vendored Datastar client. Bump, run `make vendor`, commit the result.
 DATASTAR_VERSION ?= v1.0.3
@@ -18,7 +19,7 @@ endif
 GOFILES = $(shell find . -name '*.go' -not -name '*_templ.go' 2>/dev/null)
 
 .DEFAULT_GOAL := help
-.PHONY: help generate build run seed test smoke check lint fix vendor image push release up down logs clean
+.PHONY: help generate build run seed test smoke check lint fix icons vendor image push release up down logs clean
 
 help: ## Show this help
 	@grep -hE '^[a-zA-Z_-]+:.*## ' $(MAKEFILE_LIST) \
@@ -51,10 +52,20 @@ check: ## Everything that must pass before a commit
 	@$(MAKE) --no-print-directory smoke
 	@echo "check: all passed"
 
+icons: ## Rasterise home-screen PNGs from assets/icon.svg and optimise them
+	rsvg-convert -w 180 -h 180 assets/icon.svg -o $(STATIC)/apple-touch-icon.png
+	rsvg-convert -w 192 -h 192 assets/icon.svg -o $(STATIC)/icon-192.png
+	rsvg-convert -w 512 -h 512 assets/icon.svg -o $(STATIC)/icon-512.png
+	# oxipng -o max alone loses to optipng on the 512; --zopfli wins at every
+	# size. Slow, but these are three tiny files built by hand.
+	oxipng -o max --zopfli --quiet \
+		$(STATIC)/apple-touch-icon.png $(STATIC)/icon-192.png $(STATIC)/icon-512.png
+	@ls -l $(STATIC)/*.png
+
 vendor: ## Re-download the Datastar client (DATASTAR_VERSION=v1.0.3)
-	curl -sSfL -o cmd/foodster/static/datastar.js \
+	curl -sSfL -o $(STATIC)/datastar.js \
 		"https://cdn.jsdelivr.net/gh/starfederation/datastar@$(DATASTAR_VERSION)/bundles/datastar.js"
-	@head -1 cmd/foodster/static/datastar.js
+	@head -1 $(STATIC)/datastar.js
 
 lint: generate ## go vet, gofmt check, golangci-lint when installed
 	go vet ./...