phase-7: motion, an installable app, and a capture that survives no signal

GSAP carries the counter roll-ups, the bandeja card physics, the dialog
transitions and the three success moments FLOWS.md allows. Every one of
them checks prefers-reduced-motion first and does nothing when it is set.

boneyard and canvas-ui are not what SPEC.md's stack table says they are:
on npm the names belong to two abandoned projects that do neither job.
The skeletons were already ours; the two canvas spots are now sixty lines
each with no dependency. DECISIONS.md records the substitution.

The app installs, keeps a scan taken with no network in IndexedDB and
sends it when there is one, falls back to a page that explains itself,
and can push a deadline notice. Reading the log of what is queued is the
source of truth, so the notice clears when the capture actually lands.

The CSP now allows scripts by per-request nonce rather than by
'unsafe-inline'. That forced /offline to render per request: a
prerendered page carries a build-time nonce no live policy matches, so
its scripts were blocked and it never hydrated.

Two crashes fixed on the way. web-push throws on a VAPID subject that is
not https: or mailto:, and the code handed it APP_PUBLIC_URL, so any
machine with push keys died at boot; a misconfigured optional channel now
switches itself off and says why. And a subscription the push service
answers 410 for is deleted rather than retried forever.

Lighthouse on the production build: accessibility 100, best practices 96,
SEO 100, performance 73. The performance number is not trustworthy on
this machine and DECISIONS.md says why; total blocking time did fall from
17.6s to 1.7s once the hero canvas stopped drawing at full resolution
every frame and the landing page stopped importing GSAP.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/web/app/offline/offline-notice.tsx

@@ -0,0 +1,24 @@
+'use client';
+
+import { DEFAULT_LOCALE, localeFromAcceptLanguage, t } from '@impuestos/i18n';
+import { Button } from '@/components/ui/button';
+import { Card } from '@/components/ui/card';
+import { useBrowserValue } from '@/lib/browser';
+
+export function OfflineNotice() {
+  // This page has no request locale to read, so it takes the browser's own preference.
+  const locale = useBrowserValue(
+    () => localeFromAcceptLanguage(navigator.language),
+    DEFAULT_LOCALE,
+  );
+
+  return (
+    <Card className="w-full space-y-3">
+      <h1 className="text-xl font-semibold tracking-tight">{t(locale, 'offline.title')}</h1>
+      <p className="text-sm text-[var(--text-muted)] text-pretty">{t(locale, 'offline.body')}</p>
+      <Button type="button" block onClick={() => window.location.reload()}>
+        {t(locale, 'common.retry')}
+      </Button>
+    </Card>
+  );
+}

apps/web/app/offline/page.tsx

@@ -0,0 +1,27 @@
+import type { Metadata } from 'next';
+import { OfflineNotice } from './offline-notice';
+
+export const metadata: Metadata = { title: 'Impuestos' };
+
+/**
+ * Rendered per request so it carries a live CSP nonce like every other page. Prerendered,
+ * its scripts would be stamped at build time and the policy would block them, leaving a
+ * page that renders but does not work. The service worker caches the response headers
+ * along with the body, so the copy it serves offline stays self consistent.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * What the service worker serves when a navigation cannot reach the network.
+ *
+ * It lives outside `[locale]` on purpose: the worker caches exactly one URL, and a page
+ * that only exists per locale would mean caching one and showing it to everyone. The
+ * notice picks its language in the browser instead, from the two catalogs we ship.
+ */
+export default function OfflinePage() {
+  return (
+    <main className="mx-auto flex min-h-dvh w-full max-w-md items-center px-5">
+      <OfflineNotice />
+    </main>
+  );
+}