feat(honeybar): the HoneyOS bar, loaded at runtime

A strip along the top that leads to the other apps of the same system. It is
served by HoneyOS; InkNote only says where to find it, through
INKNOTE_HONEYBAR_ORIGIN. Empty means no bar and no change at all.

The origin is served by the API rather than built into the page, because an
image is pulled ready-made and a service worker keeps whole responses: anything
frozen into index.html would outlive the setting.

Layout follows the bar through --honeybar-h. The body has overflow:hidden, so
the surplus height would not have scrolled but been cut off at the bottom; and
#root padded itself around the notch that the bar now covers, which would have
counted that gap twice.

Unit 263/263, all fourteen browser suites green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -14,6 +14,32 @@ a rebuild is not bit-identical.
 
 ---
 
+## 2026-08-25 — The bar that ties the apps together
+
+**Images** — web `sha256:7c802a96…`, server `sha256:a156fb92…`
+
+**Added**
+- **A strip along the top that leads to the other apps.** It is served by
+  HoneyOS, so what it looks like and which apps it lists are settled there —
+  InkNote only says where to find it. `INKNOTE_HONEYBAR_ORIGIN` in the `.env`
+  switches it on, empty leaves everything exactly as before.
+- **`GET /api/public/config`** hands out that origin, and the key that goes with
+  it when HoneyOS lives on a different site. Runtime, not build time: an image
+  is pulled ready-made, so a value baked in at build time could never be changed
+  from the `.env` — and a service worker keeps whole responses, headers
+  included, so anything frozen into `index.html` outlives the setting in the
+  browser. Aether learned that one the hard way first.
+
+**Changed**
+- **The app now measures its height against the bar**, in `#root` and in the
+  four places that asked for the full window. With `overflow: hidden` on the
+  body the surplus would not have scrolled — it would have been cut off at the
+  bottom, silently. And `#root` padded itself around the phone's notch, which
+  the bar now covers, so that gap would have been counted twice. Without a bar
+  `--honeybar-h` is `0px` and every one of these is what it was.
+
+---
+
 ## 2026-08-22 — A bigger face, and the theme where the settings are
 
 **Images** — web `sha256:fe35b0e7…`, server `sha256:a557fb4d…`