Bump rails main to dd1c884 + fix PWA route formats

CLAUDE.md

@@ -18,7 +18,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `bin/setup` — bootstrap dev (idempotent); requires Postgres reachable and `.env` configured
 - `bin/rails test` — Minitest. Rails 8.2's `creds` only merges `.env` in dev, so test sees nil from `creds.option(...)`; `config/database.yml` carries `root` / `password` defaults on each call as the local-dev fallback. Real `ENV` overrides if your Postgres differs. See atom `invariant_dotenv_test_env`.
 - `bin/rubocop` — omakase style (Ruby files only)
-- `bin/ci` — full local gate before a PR (config in `config/ci.rb`): setup + RuboCop + bundler-audit + importmap audit + Brakeman + tests. GitHub Actions runs the same plus Capybara system tests.
+- `bin/ci` — mandatory before ANY commit (user-mandated 2026-08-01): setup + RuboCop + bundler-audit + importmap audit + Brakeman + tests. Config in `config/ci.rb`. GitHub Actions runs the same plus Capybara system tests.
 - `bin/rails search:reindex` — rebuild every `Entry` and `SavedItem` search vector after a tokenization change; in production run it through the `bin/kamal reindex` alias after deploying the new tokenizer.
 - Recurring (`config/recurring.yml`): `RefreshDueFeedsJob` every 10 min (all envs); production also renews WebSub leases (6 h), clears finished Solid Queue jobs (hourly), and runs Rails Pulse summarize/cleanup.
 - Config is read via `Rails.app.creds.option(...)` (merges `.env` in dev, encrypted credentials in prod) — not stock `Rails.application.credentials` or bare `ENV`.

Gemfile.lock

@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/rails/rails.git
-  revision: cd269b7a6287c6fdce464c7d148202c5c4f7d179
+  revision: dd1c8848dcde00991f8d198775e08a0b44a95fac
   branch: main
   specs:
     actioncable (8.2.0.alpha)
@@ -119,7 +119,7 @@ GEM
       railties
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    annotaterb (4.23.0)
+    annotaterb (4.24.0)
       activerecord (>= 6.0.0)
       activesupport (>= 6.0.0)
     ast (2.4.3)
@@ -458,7 +458,7 @@ GEM
       activejob (>= 7.2)
       activerecord (>= 7.2)
       railties (>= 7.2)
-    solid_queue (1.5.0)
+    solid_queue (1.6.0)
       activejob (>= 7.1)
       activerecord (>= 7.1)
       concurrent-ruby (>= 1.3.1)
@@ -583,7 +583,7 @@ CHECKSUMS
   activestorage (8.2.0.alpha)
   activesupport (8.2.0.alpha)
   addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
-  annotaterb (4.23.0) sha256=0fc59b1d40e07bec75d9d9b0cd479493631ce8901e4b59fefc561689f22b4600
+  annotaterb (4.24.0) sha256=3953d3a3fb86ef06639a8d5ea29001e4af1e51cabd147973b1b23524b8fbced6
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
   async (2.42.0) sha256=536078293b8c95d5b5679fa01bf7d2458bcc65cd46dec2c4cb3580feaeb965c6
   auth-sanitizer (0.2.1) sha256=917dcf01f7589b06c26726afe90568cf2fb29d37a1f94facfc664f11967cc577
@@ -728,7 +728,7 @@ CHECKSUMS
   snaky_hash (2.0.6) sha256=3663cae48cdef582b517025cf8a39d8789996eaf0b4ed89e2f0624836505654a
   solid_cable (4.0.2)
   solid_cache (1.0.10) sha256=bc05a2fb3ac78a6f43cbb5946679cf9db67dd30d22939ededc385cb93e120d41
-  solid_queue (1.5.0) sha256=329f29caab9cc68eefe489013eb5a38ea4a66708ed2bee301384dbed91890f7f
+  solid_queue (1.6.0) sha256=b5fc3bb34162e09d8f960df6400d0f9304dc80fe66c2cfface31c32b228de6a1
   sshkit (1.25.0) sha256=c8c6543cdb60f91f1d277306d585dd11b6a064cb44eab0972827e4311ff96744
   stimulus-rails (1.3.4) sha256=765676ffa1f33af64ce026d26b48e8ffb2e0b94e0f50e9119e11d6107d67cb06
   stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1

config/routes.rb

@@ -30,9 +30,12 @@
 
   get "up" => "rails/health#show", as: :rails_health_check
 
-  # Render dynamic PWA files from app/views/pwa/*
-  get "manifest" => "rails/pwa#manifest", as: :pwa_manifest
-  get "service-worker" => "rails/pwa#service_worker", as: :pwa_service_worker
+  # Render dynamic PWA files from app/views/pwa/*. Each exists in a single
+  # format (manifest.json.erb, service-worker.js), so pin it — clients that
+  # don't Accept it (crawlers send no Accept header) would otherwise 500 with
+  # a MissingTemplate looking for an HTML variant.
+  get "manifest" => "rails/pwa#manifest", as: :pwa_manifest, defaults: { format: "json" }
+  get "service-worker" => "rails/pwa#service_worker", as: :pwa_service_worker, defaults: { format: "js" }
   get "offline" => "pwa#offline", as: :pwa_offline
 
   # Self-hosted performance monitoring dashboard (admin-only; see config/initializers/rails_pulse.rb)