Clear offline data on logout, test offline plan and recipe reads, drop Pillow

- POST /auth/logout answers with Clear-Site-Data: "storage", "cache", which
  removes the verified-session marker, the service worker and its caches, so
  an offline visit after logout cannot reopen household data. The 401/403
  clearing path is unchanged.
- The service worker no longer answers network-only requests; it leaves them
  to the browser. Chrome stalls a Clear-Site-Data navigation that the worker
  answered, so the logout POST must bypass it.
- New tests send plan and recipe reads through the real API client and the
  real network-first strategy online, then serve them from the cache offline.
- The icon generator is now Go on golang.org/x/image (approved) instead of
  Python on Pillow; the icons are regenerated with it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session_test.go

@@ -440,6 +440,9 @@ func TestLogout(t *testing.T) {
 	if !strings.HasPrefix(raw, SessionCookieName+"=;") || !strings.Contains(raw, "Max-Age=0") {
 		t.Errorf("logout Set-Cookie = %q, want the cookie cleared", raw)
 	}
+	if got := resp.Header.Get("Clear-Site-Data"); got != `"storage", "cache"` {
+		t.Errorf("logout Clear-Site-Data = %q, want the PWA's storage and caches cleared", got)
+	}
 
 	rows := h.rows(t)
 	if len(rows) != 1 || rows[0].idHash != sha256Hex(other.Value) {
@@ -461,6 +464,9 @@ func TestLogoutWithoutSession(t *testing.T) {
 		t.Errorf("logout = %d to %q, want 303 to the end session endpoint", resp.StatusCode, resp.Header.Get("Location"))
 	}
 	assertSessionCookieAttributes(t, sessionSetCookie(t, resp))
+	if got := resp.Header.Get("Clear-Site-Data"); got != `"storage", "cache"` {
+		t.Errorf("logout Clear-Site-Data = %q, want the PWA's storage and caches cleared", got)
+	}
 }
 
 func TestLogoutIsPostOnly(t *testing.T) {