The whole hvac SPA shares one index.html/<link rel=manifest>, so 'Install'
from any route always used the main manifest (start_url '/hvac/', staff
AuthGate) -- hit 2026-08-26, installing from /hvac/kiosk opened the staff
login instead of the kiosk password prompt.
Fix: new static kiosk-manifest.webmanifest (start_url/scope '/hvac/kiosk',
name 'HVAC Kiosk'), swapped into the document's manifest link while the
Kiosk route is mounted (useKioskManifest hook), restored on unmount. Reuses
the existing hvac icon set.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
