feat: convert to PWA — OPFS storage, service worker, Bun/Hono server

- Move native shells (Zig/src, Tauri/src-tauri, app.zon, releases) to legacy/
- Add Bun + Hono server with yt-dlp proxy endpoints (search, channel, streams,
  download), libsql (concurrent SQLite fork) for fingerprint-keyed playlist/
  history sync, and static file serving for the frontend
- Add Dockerfile + docker-compose.yml (single container, volume-mounted DB)
- Add frontend/sw.js: app-shell cache-first, /api/* network-only,
  thumbnails stale-while-revalidate, SW_UPDATE_AVAILABLE broadcast,
  SKIP_WAITING message handler for seamless auto-update
- Add frontend/manifest.webmanifest: standalone PWA, vermilion theme,
  search/history shortcuts
- Add frontend/icons/icon-{192,512}.png: generated PWA icons
- Add frontend/fingerprint.js: canvas+UA djb2 fingerprint, localStorage-cached,
  exposes window.getFingerprint() for server-side playlist keying
- Add frontend/opfs.js: full OPFS video store (writeFromResponse streams
  directly without full-file buffering), exposes window.OPFS
- Add scripts/make-pwa-icons.js: regenerate icons without external deps
- Patch frontend/app.js: WEB mode detection, webFetch + opfs* bridge wrappers,
  API object routes to WEB helpers when no native bridge present,
  Player.loadVideo handles OPFS blob URLs + revokes them on next load,
  SW registration + update banner in boot()
- Patch frontend/index.html: manifest link, theme-color, Apple PWA meta,
  CSP blob:/worker-src, fingerprint.js + opfs.js script tags
- Patch frontend/styles.css: .toast-update + .toast-reload-btn for update banner
- Native Tauri/Zig builds unchanged — all new code is additive via WEB flag

Dockerfile

@@ -0,0 +1,51 @@
+# ============================================================================
+# YT Player PWA — Docker image
+#
+# Base: oven/bun:1-debian (Bun runtime on Debian slim)
+# yt-dlp: downloaded from GitHub releases at build time (stays current)
+# libsql: embedded via @libsql/client (no separate DB container needed)
+#
+# Build:  docker compose build
+# Run:    docker compose up
+# ============================================================================
+
+FROM oven/bun:1-debian
+
+# ---- System dependencies ----
+# python3 is required by yt-dlp for some extraction paths
+# ca-certificates for HTTPS fetches from yt-dlp
+RUN apt-get update -qq && \
+    apt-get install -y --no-install-recommends \
+      curl \
+      python3 \
+      ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# ---- Install yt-dlp ----
+RUN curl -fsSL \
+      https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp \
+      -o /usr/local/bin/yt-dlp && \
+    chmod +x /usr/local/bin/yt-dlp
+
+WORKDIR /app
+
+# ---- Install Node/Bun deps ----
+COPY server/package.json ./
+RUN bun install --production
+
+# ---- Copy server source ----
+COPY server/ ./
+
+# ---- Copy built frontend (served as static files from ./public) ----
+COPY frontend/ ./public/
+
+# ---- Persistent data directory (volume-mounted) ----
+RUN mkdir -p /app/data
+
+EXPOSE 3000
+
+# Healthcheck — ping the version endpoint
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -sf http://localhost:3000/api/version || exit 1
+
+CMD ["bun", "server.js"]