Fix blank page from stale cached assets; surface errors

A browser or CDN holding an assets/app.js from before the shell's element
IDs were renamed runs it against the newer index.php, where it grabs
btn-logout/btn-rescan/nav-user/nav-username/app — all now null — and throws
before it can unhide #app-shell. The result is a blank page whose only clue
is a TypeError in the console.

- index.php: asset() stamps local css/js with the file mtime, so a deploy is
  a new URL and a stale copy can't be paired with a newer shell.
- index.php: install an error handler ahead of every other script (capture
  phase, so failed resource loads are caught too) that paints uncaught
  errors, rejections and load failures into a #boot-error panel. It works
  even when app.js itself is what failed, which is this case.
- includes/db.php: add a register_shutdown_function fatal handler, since
  set_exception_handler never sees parse errors, exhausted memory or a
  failed require — those were ending requests with an empty body. Both
  handlers flush partial output and answer in JSON; display_errors stays off
  so a warning can't corrupt a JSON body.
- New optional DEBUG config flag adds exception type, file:line and trace to
  those responses. config.php is gitignored, so installs without the setting
  default to false.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014oyi9DMdhALrGz989MNNZJ

includes/db.php

@@ -1,16 +1,57 @@
 <?php
 require_once __DIR__ . '/../config.php';
 
-// Uncaught exceptions in web requests become JSON errors (the SPA surfaces
-// them) instead of blank 500 pages; details still go to the PHP error log.
+// DEBUG is optional: config.php is not in version control, so an install that
+// predates the setting simply behaves as if it were false.
+if (!defined('DEBUG')) {
+    define('DEBUG', false);
+}
+
+// Everything is logged either way. DEBUG only controls how much detail is sent
+// back to the browser — never turn it on for an install exposed to the public,
+// since the payload includes file paths and stack traces.
+error_reporting(E_ALL);
+ini_set('log_errors', '1');
+// Errors must never be printed inline: every endpoint here answers with JSON,
+// and a warning echoed before the body would corrupt it. They travel in the
+// JSON payload below instead.
+ini_set('display_errors', '0');
+
 if (PHP_SAPI !== 'cli') {
-    set_exception_handler(function (Throwable $e): void {
-        error_log($e);
-        http_response_code(500);
+    /** Send a JSON error body, replacing whatever partial output exists. */
+    $emit = function (string $message, array $debug = []): void {
         if (!headers_sent()) {
+            http_response_code(500);
             header('Content-Type: application/json');
         }
-        echo json_encode(['error' => 'Server error: ' . $e->getMessage()]);
+        while (ob_get_level() > 0) {
+            ob_end_clean();
+        }
+        echo json_encode(DEBUG ? ['error' => $message] + $debug : ['error' => $message]);
+    };
+
+    // Uncaught exceptions become JSON errors (the SPA surfaces them) instead
+    // of blank 500 pages.
+    set_exception_handler(function (Throwable $e) use ($emit): void {
+        error_log($e);
+        $emit('Server error: ' . $e->getMessage(), [
+            'type'  => get_class($e),
+            'file'  => $e->getFile() . ':' . $e->getLine(),
+            'trace' => explode("\n", $e->getTraceAsString()),
+        ]);
+    });
+
+    // set_exception_handler never sees fatals (parse errors, exhausted memory,
+    // failed require) — those end the request silently and are the usual cause
+    // of an endpoint returning an empty body. Catch them on shutdown.
+    register_shutdown_function(function () use ($emit): void {
+        $err = error_get_last();
+        if ($err === null || !($err['type'] & (E_ERROR | E_PARSE | E_CORE_ERROR | E_COMPILE_ERROR))) {
+            return;
+        }
+        $emit('Fatal error: ' . $err['message'], [
+            'file' => $err['file'] . ':' . $err['line'],
+        ]);
     });
 }