feat: serve PWA web app manifest at /manifest.json

[ilfroloff]

Why

Swing Music already uses VitePWA on the frontend, which generates a
manifest.json at build time. However, the Flask backend had no route
to serve that file, so browsers received a 404 when requesting
/manifest.json directly from the production server (port 1970).

Without a valid manifest, browsers cannot:

• offer "Add to Home Screen" / install prompts
• apply the correct theme colour to the title bar on mobile
• display the app name / icons in the OS task-switcher

What this PR does

1. Adds src/swingmusic/assets/manifest.json – a fully-specified
   PWA Web App Manifest bundled with the server. It is used as a
   fallback when a client build is not present.

2. Adds a /manifest.json route in app_builder.py that:

   • Serves manifest.json from the client build folder (the file
     generated by VitePWA) when it exists, so the frontend is the
     source of truth in production.
   • Falls back to the bundled asset when no client build is present
     (e.g. bare server installs, CI, development without a built
     client).
   • Always sets the correct Content-Type: application/manifest+json.

3. Exempts /manifest.json from JWT auth so browsers can fetch it
   before the user has logged in (required for install-prompt to fire).

4. Fixes load_plugins() indentation – the function body was
   indented at 8 spaces (double indent) instead of the standard 4.

Testing

uv run --python 3.12 python -m swingmusic --port 1980
curl -I http://localhost:1980/manifest.json
# → HTTP/1.1 200 OK
# → Content-Type: application/manifest+json

Related

Companion PR in swingmx/webclient configures VitePWA to emit
manifest.json (instead of the default manifest.webmanifest) and
removes the empty public/site.webmanifest placeholder.

[CLAassistant]

All committers have signed the CLA.