fix(pwa): drop the Medications home-screen shortcut

The manifest is one static file for every account, so the Medications
shortcut was offered with the module switched off and opened its
"switched off" notice. Only shortcuts into pages no module can turn off
remain: Add measurement and Today. The `source=shortcut` parameter goes
too; nothing read it, and the measurements filter discarded it as an
unknown data source. The install `id` keeps its `source=pwa`, which is
an identity string only.

public/manifest.json

@@ -40,7 +40,7 @@
     {
       "name": "Add measurement",
       "short_name": "Add",
-      "url": "/measurements?add=WEIGHT&source=shortcut",
+      "url": "/measurements?add=WEIGHT",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]
@@ -48,15 +48,7 @@
     {
       "name": "Today",
       "short_name": "Today",
-      "url": "/?source=shortcut",
-      "icons": [
-        { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
-      ]
-    },
-    {
-      "name": "Medications",
-      "short_name": "Meds",
-      "url": "/medications?source=shortcut",
+      "url": "/",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]

src/__tests__/sw-security-hardening.test.ts

@@ -2,6 +2,8 @@ import { describe, expect, it } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { surfaceModule } from "@/lib/modules/surface";
+
 /**
  * F-7 (mobile security audit, 2026-05-16): three regressions to lock
  * in for `public/sw.js`.
@@ -107,3 +109,25 @@ describe("public/manifest.json PWA identity hygiene (F-7, 2026-05-16)", () => {
     expect(manifest.start_url).toBe("/");
   });
 });
+
+describe("public/manifest.json shortcuts", () => {
+  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf-8")) as {
+    shortcuts: Array<{ name: string; url: string }>;
+  };
+
+  it("open only pages no module can switch off", () => {
+    // The manifest is static: a shortcut into a module would open the
+    // "switched off" notice for everyone who turned that module off.
+    expect(manifest.shortcuts.length).toBeGreaterThan(0);
+    for (const { name, url } of manifest.shortcuts) {
+      const { pathname } = new URL(url, "https://app.example");
+      expect(surfaceModule(`nav:${pathname}`), name).toBeUndefined();
+    }
+  });
+
+  it("carry no query parameter the app does not read", () => {
+    for (const { name, url } of manifest.shortcuts) {
+      expect(url, name).not.toContain("source=");
+    }
+  });
+});