Add a favicon, home-screen icons and a web manifest

The favicon is a bowl of soup: this household's catalog is half keitto, so it
is at least honest. favicon.svg follows the system theme in the tab strip.

Home-screen icons cannot do the same. They must be opaque and must not change
with the theme, so assets/icon.svg is a separate fixed-colour source, with the
artwork inside the central 80% for Android to mask to any launcher shape. The
same 512 is declared maskable in the manifest.

`make icons` rasterises with rsvg-convert and compresses with
`oxipng -o max --zopfli`, which beat `optipng -o7` at every size — 5860 bytes
against 6109 for the three files. Plain `oxipng -o max` was not an upgrade: it
won the two small icons and lost the 512, ending up larger overall. All output
verified pixel-identical to the rasterizer. The PNGs are committed so the
build needs no rasterizer.

Two things that only fail on a real device, so both are covered by smoke
checks: Go has no mime entry for .webmanifest and served it as octet-stream,
which browsers ignore; and a manifest fetch carries no credentials by default,
so behind Basic auth it needs crossorigin="use-credentials" or it 401s.

mockups/favicon/a-kulho.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" role="img" aria-label="Foodster">
+  <!-- Kulho: a bowl with steam. Finnish dinner is soup more often than not,
+       and this household's own catalog is half keitto. -->
+  <style>
+    svg { color: #15616D; }
+    @media (prefers-color-scheme: dark) { svg { color: #58C6D2; } }
+  </style>
+  <g fill="currentColor">
+    <rect x="1.5" y="12" width="29" height="3.2" rx="1.6"/>
+    <path d="M3.5 15.2 h25 a12.5 12.5 0 0 1 -25 0 z"/>
+  </g>
+  <g fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round">
+    <path d="M11.5 9 c0 -2.1 2.1 -2.6 2.1 -4.6"/>
+    <path d="M19 9 c0 -2.1 2.1 -2.6 2.1 -4.6"/>
+  </g>
+</svg>