feat: enhance security audit and CSP configuration for admin interface

public/sw.js

@@ -66,13 +66,24 @@ self.addEventListener('fetch', (event) => {
           caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
           return response;
         })
-        .catch(() => caches.match('/admin'))
+        // Offline: fall back to the cached shell. If it was never cached, return a
+        // real offline Response — respondWith(undefined) throws "Failed to convert
+        // value to 'Response'" and surfaces as a network error in the console.
+        .catch(async () =>
+          (await caches.match('/admin')) ||
+          new Response('آفلاین هستید', {
+            status: 503,
+            headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+          })
+        )
     );
     return;
   }
 
   // Everything else → Network First with cache fallback
   event.respondWith(
-    fetch(request).catch(() => caches.match(request))
+    fetch(request).catch(async () =>
+      (await caches.match(request)) || Response.error()
+    )
   );
 });