Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
The challenge can’t be exempted for the manifest, the service worker or the icon URLs. It’s mandatory on all free accounts and can’t be turned off or set per URL. The knowledge base article on it lists progressive web apps among the things that don’t work with it, because it needs JavaScript and cookies. That fits what you’re seeing: the request for manifest.json gets the challenge HTML instead of your JSON.
The article about the security system:
The supported workaround is in a community guide on making a PWA on InfinityFree. Instead of linking a manifest.json file, you build the manifest in JavaScript in the page <head>. You turn it into a blob and add a <link rel="manifest"> that points at the blob URL. The browser never requests a manifest file, so the challenge has nothing to intercept. The guide has the full code to copy.
The guide also says a PWA on the free plan will sometimes need internet access. When the security cookie expires, the server has to issue a new one.
I could only read part of the guide. The rest was cut off, so I can’t say what it covers for the service worker and icon files. Try the blob manifest first. If Android Chrome still refuses to install, tell me what DevTools shows for the service worker and icon requests.
If you need the manifest, service worker and icons served as plain files, the article says premium hosting uses less restrictive protection that allows apps and APIs to work normally.