Don't let third-party script failures mask a working app

The boot guard reported every failed resource behind a full-screen
#boot-error panel. Cloudflare injects beacon.min.js at the edge, and ad
blockers and filtering DNS block it routinely, so a blocked analytics
script painted "CourseHub failed to start" over an app that had started
fine.

Mark the resources we actually ship with data-boot-critical and ignore
the rest, and stop showing the panel once app.js has a UI on screen —
that also keeps a late unhandled rejection (a dropped fetch in loadMeta,
a flaky scan) from covering a running app. A genuine failure of app.js
itself still reports as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TD5SRevPpgFguCwzNv9ZR7

assets/app.js

@@ -451,16 +451,22 @@
 
   /* ---------- auth ---------- */
 
+  /* Tells the boot-error handler in index.php that a UI is on screen, so later
+     failures get logged instead of buried under a full-screen error panel. */
+  function markBooted() { window.__chBooted = true; }
+
   function showAuth() {
     if (cleanupView) { cleanupView(); cleanupView = null; }
     shell.hidden = true;
     authEl.hidden = false;
     renderLogin();
+    markBooted();
   }
 
   function showShell() {
     authEl.hidden = true;
     shell.hidden = false;
+    markBooted();
   }
 
   function renderLogin(error = '') {