Fix blank page from stale cached assets; surface errors

A browser or CDN holding an assets/app.js from before the shell's element
IDs were renamed runs it against the newer index.php, where it grabs
btn-logout/btn-rescan/nav-user/nav-username/app — all now null — and throws
before it can unhide #app-shell. The result is a blank page whose only clue
is a TypeError in the console.

- index.php: asset() stamps local css/js with the file mtime, so a deploy is
  a new URL and a stale copy can't be paired with a newer shell.
- index.php: install an error handler ahead of every other script (capture
  phase, so failed resource loads are caught too) that paints uncaught
  errors, rejections and load failures into a #boot-error panel. It works
  even when app.js itself is what failed, which is this case.
- includes/db.php: add a register_shutdown_function fatal handler, since
  set_exception_handler never sees parse errors, exhausted memory or a
  failed require — those were ending requests with an empty body. Both
  handlers flush partial output and answer in JSON; display_errors stays off
  so a warning can't corrupt a JSON body.
- New optional DEBUG config flag adds exception type, file:line and trace to
  those responses. config.php is gitignored, so installs without the setting
  default to false.

Claude-Session: https://claude.ai/code/session_014oyi9DMdhALrGz989MNNZJ

config.example.php

@@ -18,3 +18,8 @@ define('COMPLETE_THRESHOLD', 0.95);
 
 // Allow new users to self-register from the login page.
 define('ALLOW_REGISTRATION', true);
+
+// Return the exception type, file:line and stack trace in API error responses.
+// Errors are written to the PHP error log either way — this only controls what
+// the browser is told, so leave it false on anything publicly reachable.
+define('DEBUG', false);