PWA: installable app (web/win/android/ios) + download/help page + push notifications

- manifest.webmanifest + service worker (offline shell + push + notificationclick) + PNG icons (192/512/apple) + iOS meta + SW registration → installable everywhere
- /Download page: per-OS install help (web/windows/android/ios), install button (beforeinstallprompt), 'enable notifications' flow, usage guide, Bazaar/TWA note; nav + footer links
- Web Push foundation: WebPushSubscription entity + /push/subscribe (stores), VAPID + push settings in /Admin/Settings, on-device local notification; server broadcast documented (WebPush via Nexus)
- docs/PWA-TWA.md: VAPID keygen, server-push wiring, Bubblewrap→Cafe Bazaar + assetlinks steps
- Verified: manifest/sw/icons served, download page, subscribe stores (200), layout wired

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/JobsMedical.Web/Program.cs

@@ -119,6 +119,64 @@ app.MapRazorPages()
 // Lightweight liveness probe for the deploy health-wait loop (and uptime checks).
 app.MapGet("/healthz", () => Results.Text("ok"));
 
+// ---- PWA: web manifest + service worker (served from root for full scope) ----
+app.MapGet("/manifest.webmanifest", () => Results.Content("""
+{
+  "name": "همکادر — شیفت و استخدام کادر درمان",
+  "short_name": "همکادر",
+  "lang": "fa", "dir": "rtl",
+  "start_url": "/", "scope": "/",
+  "display": "standalone", "orientation": "portrait",
+  "background_color": "#f4f7f9", "theme_color": "#0e8f8a",
+  "icons": [
+    { "src": "/icons/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any maskable" },
+    { "src": "/icons/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any maskable" }
+  ],
+  "shortcuts": [
+    { "name": "شیفت‌ها", "url": "/Shifts" },
+    { "name": "استخدام", "url": "/Jobs" }
+  ]
+}
+""", "application/manifest+json"));
+
+// Store a browser's push subscription (from the "enable notifications" flow).
+app.MapPost("/push/subscribe", async (PushSubscriptionDto dto, AppDbContext db, VisitorContext vc) =>
+{
+    if (string.IsNullOrWhiteSpace(dto.Endpoint) || dto.Keys?.P256dh is null || dto.Keys?.Auth is null)
+        return Results.BadRequest();
+    if (!await db.WebPushSubscriptions.AnyAsync(s => s.Endpoint == dto.Endpoint))
+    {
+        db.WebPushSubscriptions.Add(new WebPushSubscription
+        {
+            Endpoint = dto.Endpoint, P256dh = dto.Keys.P256dh, Auth = dto.Keys.Auth, VisitorId = vc.VisitorId,
+        });
+        await db.SaveChangesAsync();
+    }
+    return Results.Ok();
+});
+
+app.MapGet("/sw.js", () => Results.Content("""
+const CACHE = 'hamkadr-v1';
+self.addEventListener('install', e => { self.skipWaiting(); e.waitUntil(caches.open(CACHE).then(c => c.addAll(['/']))); });
+self.addEventListener('activate', e => { e.waitUntil(caches.keys().then(ks => Promise.all(ks.filter(k => k !== CACHE).map(k => caches.delete(k))))); self.clients.claim(); });
+self.addEventListener('fetch', e => {
+  const req = e.request;
+  if (req.method !== 'GET' || new URL(req.url).origin !== location.origin) return;
+  e.respondWith(fetch(req).then(res => { const copy = res.clone(); caches.open(CACHE).then(c => c.put(req, copy)); return res; })
+    .catch(() => caches.match(req).then(m => m || caches.match('/'))));
+});
+self.addEventListener('push', e => {
+  let d = { title: 'همکادر', body: 'فرصت جدید برای شما', url: '/' };
+  try { if (e.data) d = Object.assign(d, e.data.json()); } catch (_) { if (e.data) d.body = e.data.text(); }
+  e.waitUntil(self.registration.showNotification(d.title, { body: d.body, icon: '/icons/icon-192.png', badge: '/icons/icon-192.png', dir: 'rtl', lang: 'fa', data: { url: d.url } }));
+});
+self.addEventListener('notificationclick', e => {
+  e.notification.close();
+  const url = (e.notification.data && e.notification.data.url) || '/';
+  e.waitUntil(clients.matchAll({ type: 'window' }).then(cl => { for (const c of cl) { if ('focus' in c) { c.navigate(url); return c.focus(); } } return clients.openWindow(url); }));
+});
+""", "text/javascript"));
+
 // ---- SEO: robots.txt + dynamic sitemap.xml (so Google indexes every live shift/job page) ----
 app.MapGet("/robots.txt", (HttpContext ctx) =>
 {