In order to eliminate insecure legacy dependencies, our PWA must transition from @lcdp/offline-plugin to workbox-webpack-plugin:

• The webpack build adds a production-only GenerateSW plugin that writes sw.js, precaches hashed bundles under static/build/, excludes .map, .txt, and assets.json, and limits precached file size to 5 MiB.
• Runtime registration in frontend/src/app.js now registers the Workbox service worker whenever navigator.serviceWorker is available, deriving both scope and URL from $config.baseUri, so non-root deployments are supported by default.
• No backend changes are required.