Add phase 5: link import, Instagram fallback and share target

- SSRF-safe fetcher: public IPs only, connects to the checked address,
  redirects re-validated, size/time limits, honest user agent
- schema.org/Recipe JSON-LD extraction (graphs, HowToSections, ISO
  durations, yields, keywords, images) without extra dependencies;
  AI fallback on plain page text when no structured recipe exists
- Instagram: one login-free request to the public embed page; when
  Instagram withholds the caption, the import page explains how to paste
  the text or import a screenshot instead
- Suggested source photo can be downloaded and attached on save
- Text import works without AI (text becomes the description)
- Installable PWA with manifest, icons and Android share target
- Offline tests for SSRF rules, parsers, Instagram and import views

Co-Authored-By: Claude Opus 5.5 <[email protected]>

static/css/app.css

@@ -280,3 +280,6 @@ h3 { font-size: 1rem; margin: 1rem 0 0.25rem; color: var(--muted); }
 .preview .ingredients .amount { flex-basis: 5.5rem; }
 button[disabled] { opacity: 0.6; cursor: progress; }
 code { font-size: 0.9em; }
+.help-box { border-left: 4px solid var(--accent); }
+.help-box ol { padding-left: 1.2rem; margin: 0; }
+.help-box li { margin-bottom: 0.4rem; }

static/js/app.js

@@ -61,3 +61,8 @@ window.addEventListener("pageshow", () => {
     b.textContent = b.dataset.label;
   });
 });
+
+// Register the (no-cache) service worker so the app can be installed and used as share target.
+if ("serviceWorker" in navigator) {
+  window.addEventListener("load", () => navigator.serviceWorker.register("/sw.js").catch(() => {}));
+}