Precache hashed bundles and revision the PWA service worker

- Add a build-only Vite plugin (admin/vite-sw-plugin.ts) that, after the
  bundle is written, injects every same-origin script/link asset referenced
  by dist/index.html into dist/sw.js's precache, so the offline shell renders
  immediately after install (PWA-001).
- Replace the literal cache version with a build revision (sha256 of the built
  index.html and sw.js source, truncated) used in both cache names, so each
  release installs a new worker with fresh caches (PWA-002).
- On activate, delete only stale nestquest-admin-* caches; unrelated
  same-origin caches survive (PWA-003).
- Add Vitest regressions for all three findings.

Task: 96ab3c0b-7554-4098-8af1-2be7815f8929

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

admin/public/sw.js

@@ -2,20 +2,29 @@
    Precaches the app shell, serves static assets cache-first, and falls back
    to the cached shell for navigations when offline. Only same-origin GET
    requests are handled; cross-origin requests (Authentik, the API host) are
-   never intercepted or cached. */
+   never intercepted or cached.
+   The build (vite-sw-plugin.ts) replaces PRECACHE_ASSETS with the hashed
+   bundles referenced by index.html and the revision marker with a content
+   hash, so each release installs a new worker with fresh caches. */
 
-const VERSION = "v1";
-const SHELL_CACHE = `nestquest-admin-shell-${VERSION}`;
-const RUNTIME_CACHE = `nestquest-admin-runtime-${VERSION}`;
+const REVISION = "__NQ_BUILD_REVISION__";
+const CACHE_PREFIX = "nestquest-admin-";
+const SHELL_CACHE = `${CACHE_PREFIX}shell-${REVISION}`;
+const RUNTIME_CACHE = `${CACHE_PREFIX}runtime-${REVISION}`;
 const CURRENT_CACHES = [SHELL_CACHE, RUNTIME_CACHE];
 
+const PRECACHE_ASSETS = [];
+
 const SHELL_URLS = [
-  "/",
-  "/index.html",
-  "/manifest.webmanifest",
-  "/icons/icon-192.png",
-  "/icons/icon-512.png",
-  "/icons/icon-maskable-512.png",
+  ...new Set([
+    "/",
+    "/index.html",
+    "/manifest.webmanifest",
+    "/icons/icon-192.png",
+    "/icons/icon-512.png",
+    "/icons/icon-maskable-512.png",
+    ...PRECACHE_ASSETS,
+  ]),
 ];
 
 // Request destinations treated as static assets (cache-first). Anything else
@@ -37,7 +46,9 @@ self.addEventListener("activate", (event) => {
       .keys()
       .then((keys) =>
         Promise.all(
-          keys.filter((key) => !CURRENT_CACHES.includes(key)).map((key) => caches.delete(key)),
+          keys
+            .filter((key) => key.startsWith(CACHE_PREFIX) && !CURRENT_CACHES.includes(key))
+            .map((key) => caches.delete(key)),
         ),
       )
       .then(() => self.clients.claim()),