Add a favicon, home-screen icons and a web manifest

The favicon is a bowl of soup: this household's catalog is half keitto, so it
is at least honest. favicon.svg follows the system theme in the tab strip.

Home-screen icons cannot do the same. They must be opaque and must not change
with the theme, so assets/icon.svg is a separate fixed-colour source, with the
artwork inside the central 80% for Android to mask to any launcher shape. The
same 512 is declared maskable in the manifest.

`make icons` rasterises with rsvg-convert and compresses with
`oxipng -o max --zopfli`, which beat `optipng -o7` at every size — 5860 bytes
against 6109 for the three files. Plain `oxipng -o max` was not an upgrade: it
won the two small icons and lost the 512, ending up larger overall. All output
verified pixel-identical to the rasterizer. The PNGs are committed so the
build needs no rasterizer.

Two things that only fail on a real device, so both are covered by smoke
checks: Go has no mime entry for .webmanifest and served it as octet-stream,
which browsers ignore; and a manifest fetch carries no credentials by default,
so behind Basic auth it needs crossorigin="use-credentials" or it 401s.

README.md

@@ -27,8 +27,12 @@ Working:
 
 Still to build:
 
+- **UI polish.** Checkbox chips hide the native control and signal state only
+  through background colour, so "Tarjoillaan lisukkeiden kanssa" gives no
+  clear read of on versus off. Show a real checkbox. Same applies to the
+  category and side chips.
 - Light / dark theme switch, saved per device (PRD §7.4).
-- A proper app header and a `favicon.svg`.
+- A proper app header.
 - Stage 2: the seven-meal suggester, which starts once there is history to
   weight against.
 
@@ -102,6 +106,21 @@ a scratch database:
 make seed                      # or: SEED=seeds/other.json make seed
 ```
 
+## Icons
+
+`cmd/foodster/static/favicon.svg` is the browser-tab icon and follows the
+system theme. The home-screen icons are PNGs, because a home-screen icon
+cannot be transparent and must not change with the theme; they are rasterised
+from `assets/icon.svg`, which is opaque and keeps the artwork inside the
+central 80% so Android can mask it to any shape.
+
+```sh
+make icons      # rsvg-convert, then optipng -o7
+```
+
+The PNGs are committed so the build needs no rasterizer. Re-run `make icons`
+after editing `assets/icon.svg`.
+
 ## Migrations
 
 Numbered SQL files in `cmd/foodster/migrations`, embedded in the binary and