feat: PWA support — manifest, service worker, icons, public auth exemption

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/auth_middleware.py

@@ -17,7 +17,7 @@ from starlette.responses import RedirectResponse, JSONResponse
 from auth_utils import COOKIE_NAME, decode_token
 
 # Paths that don't require a session cookie
-_PUBLIC = {"/login", "/logout", "/health"}
+_PUBLIC = {"/login", "/logout", "/health", "/manifest.json", "/sw.js", "/favicon.ico"}
 
 # Path prefixes that are always public (setup flow + webhooks + Google OAuth)
 _PUBLIC_PREFIXES = ("/setup/", "/channels/", "/webhook/", "/auth/google")