Hide candidate URLs, report unavailable notifications, clear grounded links

Release corrections from the review of promotion pull request #98:

- MQ-98-01: recipe-candidates returns an opaque candidate_id (an HMAC of
  the dinner and page under a per-process key) that the server resolves
  to the page it last offered that dinner. Candidate URLs, which may
  carry a token, no longer reach responses or the service-worker cache.
- MQ-98-02: "Turn on notifications" no longer finishes onboarding
  silently when notifications are unavailable (or denied); the step says
  plainly that nothing was turned on and offers "Finish setting up".
  The placeholder stays until Feature 19 wires Web Push.
- MQ-98-03: GroundPendingDinner clears the pasted recipe_url when
  background grounding succeeds, as manual grounding already did.

Maestro task 6819ce33-3715-4bd4-9208-a54a8b5cee02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/frontend/dist/index.html

@@ -2,10 +2,14 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#5a358c" />
+    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <title>MealQuest</title>
-  </head>
+    <script type="module" crossorigin src="/assets/index-CtlEgrTB.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CbjluR9l.css">
+  <link rel="manifest" href="/manifest.webmanifest"><script id="vite-plugin-pwa:register-sw" src="/registerSW.js"></script></head>
   <body>
-    <!-- Placeholder so the Go embed compiles. The build replaces this directory with web/dist. -->
-    <p>MealQuest web assets have not been built.</p>
+    <div id="root"></div>
   </body>
 </html>