Fix PWA shortcut icon on Windows

Allow unauthenticated access to favicon and manifest, generate favicon.ico, and add multi-size manifest icons.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/index.js

@@ -89,11 +89,33 @@ function isAuthenticated(req) {
   return Boolean(req.session?.user)
 }
 
+const PUBLIC_PATHS = new Set([
+  '/favicon.ico',
+  '/favicon.png',
+  '/favicon.svg',
+  '/apple-touch-icon.png',
+  '/icon-192.png',
+  '/icon-512.png',
+  '/site.webmanifest',
+  '/vp-icons.css',
+  '/hashmap.json',
+])
+
+function isPublicPath(reqPath) {
+  if (PUBLIC_PATHS.has(reqPath)) return true
+  if (reqPath.startsWith('/assets/')) return true
+  return false
+}
+
 function authGuard(req, res, next) {
   if (req.path === '/login' || req.path.startsWith('/api/login')) {
     return next()
   }
 
+  if (isPublicPath(req.path)) {
+    return next()
+  }
+
   if (isAuthenticated(req)) {
     return next()
   }