feat: public landing page with magic login, brand palette and demo build flag

Adds a public funnel landing at `/` and moves the login to `/login`, rebuilt
around the panel's own colors instead of an invented palette.

Landing (`src/components/landing/`, one section per file, no props):
- Seven funnel sections composed by `LandingPage`. The hero's eight swatches are
  literally `PIE_COLORS` from `DashboardPage`, the same hex values the seed hands
  to avatars and services, so "your colors become your numbers" is literal.
- `BrandMark` becomes the single source for the logo, replicating
  `public/favicon.svg`. Blue is the action surface, orange only ever marks.
- `NotebookVisual` is the one deliberate exception to the palette: it is what the
  product replaces.
- Copy drops all system vocabulary; motion comes from `src/lib/motion.ts` with a
  single easing, and reduced-motion resolves `initial` to the final state so a
  never-firing `whileInView` cannot leave a section invisible forever.

Routing and bundle:
- `homePathFor` is the single definition of each role's destination.
- Landing, login, dashboard and calendar load lazily. Eager, the login dragged
  framer-motion (~40 KB gz) into every panel load and the landing downloaded
  recharts + FullCalendar (~187 KB gz) without charting anything. `clsx` is
  pinned to the `react` chunk because Rollup otherwise assigns it to `charts`,
  making the entry import 111 KB gz for a 200-byte utility.

Responsiveness (iPhone/iPad), verified with `npm run audit:responsive`:
- No touch form field below 16px, `dvh` height utilities, safe-area insets, and
  40px touch targets keyed off `pointer: coarse` rather than `sm:`.
- New `.ld-gutter`: `.safe-x` lives outside `@layer` and beats Tailwind's `px-*`,
  so it left the login's side padding at 0 on anything but an iPhone in
  landscape. No overflow check could see it — there was no overflow, just zero
  margin. The audit now guards it with a `gutter` check.
- `shell-height` no longer fires on pages that legitimately scroll; the static
  `raw-viewport-unit` scan covers those instead.

Production build:
- The Dockerfile now sets `VITE_DEMO_UI=1` as a build arg. `DEMO` is a build-time
  constant, so without it Vite eliminated the magic login and the "Ver como…"
  switcher: the deployed landing promised "no registration" and led to an empty
  form. Verified by building both ways and diffing the bundle.
- Service worker cache bumped to v2 so the orphaned pre-landing chunks get purged
  from returning visitors' caches.

Verified: typecheck clean; unit 39/39, e2e 33/33, admin 17/17, booking 12/12,
landing 13/13 (WebKit), PWA passed against the real production build.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.superpowers/sdd/task-2-report.md

@@ -1,61 +1,38 @@
-# Task 2 Report — scheduling.ts pure functions + unit tests
+# Task 2 Implementation Report
 
-## Status
-✅ COMPLETE — all acceptance criteria met.
+## Scope
 
-## Files changed
-- **Created** `server/lib/scheduling.ts` — 15 pure exports (types + functions), zero imports. ~95 lines.
-- **Created** `server/lib/scheduling.test.ts` — 15 `test()` blocks using `node:test` + `node:assert/strict`.
-- **Modified** `package.json` — added `"test:unit": "node --import tsx --test server/lib/scheduling.test.ts"` to `scripts`.
+Implemented only the production AgendaMax service worker and its production-only registration. Existing `.superpowers/sdd/*` changes and `graphify-out/*` outputs were preserved and were not staged.
+
+## Changed Files
+
+- `public/sw.js`: added versioned shell/static caching with `agendamax-shell-v1`, install/activate lifecycle handling, network-first navigation fallback, and cache-first handling limited to script, style, image, font, manifest, and worker requests.
+- `src/main.tsx`: registered `/sw.js` after the React root render only when `import.meta.env.PROD` and service workers are supported.
 
 ## Verification
 
-### `npm run typecheck` → 0 errors
-```
-> [email protected] typecheck
-> tsc -b --noEmit
-(clean — no diagnostics)
-```
-`allowImportingTsExtensions: true` is set in `tsconfig.json`, so `import { ... } from "./scheduling.ts"` resolves correctly under tsc.
+- `npm.cmd run typecheck`: exit 0.
 
-### `npm run test:unit` → all PASS
-```
-✔ parseWorkingHours: json válido → mapa 1..7
-✔ parseWorkingHours: null/invalid → null
-✔ isoDayOfWeek: lunes=1, domingo=7
-✔ getWorkingHoursForDate: empleado tiene prioridad sobre negocio
-✔ getWorkingHoursForDate: día cerrado → null
-✔ normalizeText/tokens: quita acentos y lowercase
-✔ specialtyMatch: coincidencia exacta de etiqueta → 1
-✔ specialtyMatch: etiqueta con acento/case → 1
-✔ specialtyMatch: sin etiquetas → 0.5
-✔ specialtyMatch: etiqueta no relacionada → 0.5
-✔ overlaps: bordes inclusivos de no-traslape
-✔ hasConflict: lista vacía → false
-✔ scoreCandidate: pesos 50/30/20
-✔ scoreCandidate: mayor efficiency → mayor score
-✔ scoreCandidate: menor load (más disponible) → mayor score
-ℹ tests 15
-ℹ pass 15
-ℹ fail 0
-ℹ duration_ms 201.8453
-```
+  ```text
+  > [email protected] typecheck
+  > tsc -b --noEmit
+  ```
 
-**Summary line:** `# tests 15 | # pass 15 | # fail 0 | duration 201.8 ms`
+- `npm.cmd run build`: exit 0. Vite transformed 2463 modules and emitted the production bundle.
+- `Test-Path -LiteralPath "dist/sw.js"`: `True`; Vite copied the public worker to the production output.
+- `git diff --check`: no whitespace errors. Git emitted only LF-to-CRLF normalization warnings for existing/changed working-tree files.
 
-## Deviations from plan
-- **None.** The plan said "≈14 tests" but the spec actually contains 15 `test()` blocks — all 15 are present and pass. Code is verbatim from the plan (only the pure functions; no DB imports added — those belong to Task 3).
+## Self-Review
 
-## Self-review
-
-- **All 15 tests present?** ✅ Counted 15 `test(` calls in the file; runner reports `tests 15 / pass 15`.
-- **`scoreCandidate` verifies 50/30/20 weights?** ✅ The "pesos 50/30/20" test asserts three exact points on the response surface:
-  - `(1, 1, 0)` → 100  (50·1 + 30·1 + 20·1)
-  - `(0, 0, 1)` → 0    (all terms zero)
-  - `(0.5, 0, 1)` → 25 (only specialty term contributes: 50·0.5 = 25)
-  These three points uniquely pin the 50/30/20 coefficients — any other weights would fail at least one assertion. The two follow-up tests ("mayor efficiency", "menor load") additionally confirm the monotonic direction of each knob.
-- **`overlaps` boundary case verified?** ✅ The "bordes inclusivos de no-traslape" test explicitly asserts `overlaps(100, 200, 200, 300) === false` — i.e. one window ending exactly when another starts is **not** an overlap. Two true-overlap cases (forward and reverse order) are also covered.
-- **No DB leakage?** ✅ `scheduling.ts` has zero `import` statements and does not reference `DatabaseSync`, `db`, or any module. Task 3 can append the DB section cleanly.
+- Cache name and shell URLs match the Task 2 contract exactly.
+- Activation removes older cache names and claims clients after activation.
+- Fetch handling rejects non-GET requests, cross-origin requests, and paths beginning with `/api/` before any response interception.
+- Navigation requests use network-first behavior and fall back to the cached root document.
+- Static caching is allowlisted by request destination; there is no catch-all cache path.
+- Registration is deferred until `load`, uses `{ updateViaCache: "none" }`, and registration failure is non-fatal.
+- Only `public/sw.js` and `src/main.tsx` are intended for the Task 2 commit.
 
 ## Concerns
-None. Ready for Task 3.
+
+- Validation is static/build-level only; browser service-worker runtime behavior is intentionally left to the later PWA end-to-end task.
+- `git diff --check` reports normal line-ending normalization warnings from the existing PowerShell/Git configuration, not whitespace errors.