Update host dir and release process

client/vite.config.js

@@ -66,13 +66,29 @@ export default defineConfig({
         // mid-session underneath them.
         clientsClaim: false,
         skipWaiting: false,
-        runtimeCaching: [
+        //
-          {
+        // runtimeCaching is deliberately EMPTY. Do not add an entry for /api/*
-            urlPattern: ({ url }) =>
+        // or /socket -- not even NetworkOnly.
-              url.pathname.startsWith('/api/') || url.pathname.startsWith('/socket'),
+        //
-            handler: 'NetworkOnly',
+        // There used to be a NetworkOnly route for both, as belt-and-braces for
-          },
+        // the invariant above. It was worse than useless. registerRoute() makes
-        ],
+        // the worker call event.respondWith() for every matching request, and
+        // Socket.IO's long-poll requests are aborted as a matter of course --
+        // on reconnect, on transport upgrade, and whenever Android backgrounds
+        // the page. An aborted fetch inside NetworkOnly throws Workbox's
+        // `no-response`, the respondWith promise rejects, and Socket.IO sees a
+        // dead transport and reconnects. The installed PWA was dropping its
+        // live note sync on a loop and filling the logs with
+        // "FetchEvent ... resulted in a network error response".
+        //
+        // With no route registered the worker never intercepts these at all and
+        // the browser handles them natively, exactly as in a normal tab.
+        //
+        // Nothing is lost on the security side: the invariant is enforced by
+        // globPatterns only ever reading dist/, and by there being no *caching*
+        // strategy here. NetworkOnly enforced nothing -- it only inserted the
+        // worker into the hot path of every poll.
+        //
       },
       // Flip to true temporarily to exercise the worker on the dev server.
       // Remember to unregister it afterwards -- a lingering dev service worker