Fix blank page from stale cached assets; surface errors

A browser or CDN holding an assets/app.js from before the shell's element
IDs were renamed runs it against the newer index.php, where it grabs
btn-logout/btn-rescan/nav-user/nav-username/app — all now null — and throws
before it can unhide #app-shell. The result is a blank page whose only clue
is a TypeError in the console.

- index.php: asset() stamps local css/js with the file mtime, so a deploy is
  a new URL and a stale copy can't be paired with a newer shell.
- index.php: install an error handler ahead of every other script (capture
  phase, so failed resource loads are caught too) that paints uncaught
  errors, rejections and load failures into a #boot-error panel. It works
  even when app.js itself is what failed, which is this case.
- includes/db.php: add a register_shutdown_function fatal handler, since
  set_exception_handler never sees parse errors, exhausted memory or a
  failed require — those were ending requests with an empty body. Both
  handlers flush partial output and answer in JSON; display_errors stays off
  so a warning can't corrupt a JSON body.
- New optional DEBUG config flag adds exception type, file:line and trace to
  those responses. config.php is gitignored, so installs without the setting
  default to false.

Claude-Session: https://claude.ai/code/session_014oyi9DMdhALrGz989MNNZJ

README.md

@@ -71,6 +71,10 @@ Top-level folders become courses on the home page.
      the web server / PHP user).
    - DB credentials (change the password in production).
    - `ALLOW_REGISTRATION`: set `false` once your users have accounts.
+   - `DEBUG`: include the exception type, `file:line` and stack trace in API
+     error responses. Errors go to the PHP error log either way, so leave this
+     `false` on anything publicly reachable. Installs whose `config.php`
+     predates the setting behave as if it were `false`.
 
    No external binaries are needed — PHP with PDO/MySQL is the whole
    dependency list.
@@ -212,6 +216,22 @@ next scan creates it.
   pure PHP, so listings show durations before anyone plays the video. If a file
   can't be parsed, the browser reports its duration on first play instead.
 
+## When something breaks
+
+`index.php` stamps `assets/*.css|js` with the file's mtime (`asset()`), so a
+deploy is always a fresh URL. Without that, a browser or CDN holding a stale
+`app.js` runs it against a newer shell, it grabs element IDs that no longer
+exist, and it throws before unhiding the shell — a blank page whose only clue
+is in the console. If you ever do see a blank page, hard-refresh and purge the
+CDN cache first.
+
+A small handler installed ahead of every other script catches uncaught errors,
+unhandled rejections and failed script/stylesheet loads, and paints them into a
+`#boot-error` panel — so a failure that stops the app is visible on the page
+rather than silent. Server-side, uncaught exceptions *and* fatals (via
+`register_shutdown_function`, which `set_exception_handler` never sees) are
+returned as JSON, with detail gated behind `DEBUG`.
+
 ## Production notes
 
 - PHP streams the video in 512 KB chunks with Range support, which is fine for