feat: pwa

README.md

@@ -34,6 +34,36 @@ DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.1.x:8000 uv run python manage.py runs
 
 Sessions last a year, so your phone stays logged in.
 
+## Installing it on Android (PWA)
+
+The Today page is a progressive web app: Chrome will offer *Add to home screen*
+(menu → Install app), and it then launches full-screen with its own icon, no
+browser chrome, and a year-long session. No APK, no Play Store, no Flutter.
+
+**It must be served over HTTPS** — service workers and installability are
+disabled on plain `http://` (except `localhost`). Over LAN HTTP you still get a
+usable mobile site, just a bookmark rather than an installed app. The easy ways
+to get a real certificate:
+
+```bash
+# Tailscale (private to your devices, no public exposure):
+tailscale serve --bg 8000
+# or Cloudflare Tunnel (public URL):
+cloudflared tunnel --url http://localhost:8000
+```
+
+Whichever you use, add the hostname to `DJANGO_ALLOWED_HOSTS` and
+`DJANGO_CSRF_TRUSTED_ORIGINS`.
+
+Offline behaviour is deliberately conservative: static files are cached, and the
+last-seen page is shown if you open the app with no signal, but `/api/` calls and
+every write go straight to the network — a cached or replayed dose would be a
+lie about whether the cat was medicated.
+
+If you ever do need a real APK (Play Store, or an installable file), the manifest
+here is all [PWABuilder](https://www.pwabuilder.com) needs to wrap it in a
+Trusted Web Activity — no Android SDK on your side.
+
 ## Data model
 
 - `Medication` — the drug, e.g. Vetmedin. Deactivate rather than delete when a