feat(05-04): SW migration to injectManifest with push + notificationclick + denylist

- Migrate vite.config.ts from generateSW to injectManifest (strategies, srcDir, filename)
- Add rolldownOptions.output.format=iife to produce sw.js (not sw.mjs) matching registerSW.js
- Create apps/pwa/src/sw.ts: skipWaiting+clientsClaim (autoUpdate), precacheAndRoute, NavigationRoute denylist (/callback,/api/,/health)
- Push handler: dual-format payload parsing (iOS 18.4+ declarative + legacy), ALWAYS event.waitUntil(showNotification) — never silent (D-11)
- notificationclick: close notification, focus existing window or openWindow to deep-link URL (D-14)
- Build verified: dist/sw.js contains showNotification, waitUntil, callback denylist, notificationclick

apps/pwa/vite.config.ts

@@ -7,19 +7,24 @@ export default defineConfig({
     react(),
     VitePWA({
       registerType: 'autoUpdate',
-      // ⚠️ CRITICAL: exclude /callback from SW navigation handling (Gate 2 — T-03-20)
-      // The OIDC authorization-code exchange lands on /callback — if the SW
-      // intercepts this as a navigation, it serves the cached shell instead of
-      // letting the server process the authorization code exchange (login loop).
-      workbox: {
-        navigateFallback: '/index.html',
-        navigateFallbackDenylist: [
-          /^\/callback/, // OIDC redirect endpoint — must reach the server
-          /^\/api\//, // API calls — never serve from cache
-          /^\/health/, // Health endpoint
-        ],
-        // No /api caching — runtimeCaching: [] means all API calls fall through to network
-        runtimeCaching: [],
+      // ⚠️ CRITICAL (T-03-20): generateSW migrated to injectManifest so the custom
+      // sw.ts can add push + notificationclick handlers while preserving the /callback
+      // denylist. The denylist is re-implemented explicitly in src/sw.ts.
+      strategies: 'injectManifest',
+      srcDir: 'src',
+      filename: 'sw.ts',
+      // rolldownOptions: force the SW output to IIFE so the output file is sw.js
+      // (not sw.mjs). Vite 8 + vite-plugin-pwa 1.3.x defaults to ES module SW format
+      // when the source is .ts, producing sw.mjs. The registerSW.js generated by
+      // the plugin registers '/sw.js', so the filenames must match.
+      rolldownOptions: {
+        output: {
+          format: 'iife',
+        },
+      },
+      injectManifest: {
+        // Prevent /callback-related URLs from appearing in the precache manifest.
+        globIgnores: ['**/node_modules/**', '**/callback**'],
       },
       manifest: {
         name: 'FamilySync',