Fix redirects broken by service worker navigate fallback; v1.1.31

The SW's navigateFallback was using a denylist, so any path not explicitly
excluded (e.g. /spotify, /apple, /amazon, custom admin redirects) got served
the cached index.html instead of reaching the server's redirect handler.

Switch to navigateFallbackAllowlist: the SW only intercepts known SPA routes;
all other paths hit the network so server-side 301/302 redirects work correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "siteforge",
   "private": true,
-  "version": "1.1.30",
+  "version": "1.1.31",
   "type": "module",
   "scripts": {
     "dev": "vite",

vite.config.ts

@@ -23,7 +23,15 @@ export default defineConfig({
       },
       workbox: {
         navigateFallback: '/index.html',
-        navigateFallbackDenylist: [/^\/api\//, /^\/feed\.xml/, /^\/uploads\//],
+        // Allowlist-only approach: SW only serves index.html for known SPA routes.
+        // Everything else (admin-configured redirects, /spotify, /apple, /amazon,
+        // feed.xml, robots.txt, etc.) goes to the server so server-side redirects work.
+        navigateFallbackAllowlist: [
+          /^\/$/, // exact root
+          /^\/(start-here|about|contact|resources|thanks|preview|privacy|terms|salvation)(\/.*)?$/,
+          /^\/(study|studys|episodes|finished|downloads|subscribe|certificate)(\/.*)?$/,
+          /^\/(questions|admin|email|contacts|calendar)(\/.*)?$/,
+        ],
         runtimeCaching: [
           {
             urlPattern: /^\/api\/(episodes|questions)/,