PWA: restrict navigateFallback to portal routes only

The service worker was intercepting iframe navigation to app paths
(/notices/, /kitchen/ etc.) and serving the portal's cached index.html
before the request reached nginx — causing the 🚧 EmbeddedFallback.
Only apply the fallback to portal routes; everything else goes to network.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

vite.config.ts

@@ -22,6 +22,10 @@ export default defineConfig({
       },
       workbox: {
         navigateFallback: '/index.html',
+        // Only apply the navigation fallback to the portal's own routes.
+        // App sub-paths (/notices/, /kitchen/, etc.) must reach nginx so
+        // the portal nginx can proxy them to the correct app container.
+        navigateFallbackAllowlist: [/^\/($|login|app\/|admin\/)/],
         globPatterns: ['**/*.{js,css,html,ico,png,svg}'],
       },
     }),