Observability + warming guardrails (Codex)

* client_error details, not just a count: new client_errors table + POST
  /api/client-error (reason/path/user-agent/time) + GET /api/admin/client-errors.
  The boot-seatbelt beacon now sends the reason + path (once per page); the admin
  Overview lists the recent errors so we can tell chunk vs SW vs API vs JS — the
  truth meter for the next day as the new SW propagates.
* Deploy warming now also hits the shell, routes (/play /account /admin), SW,
  version.json, word lists, and icons/logo/font — not just immutable chunks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/sync-static.sh

@@ -23,5 +23,13 @@ find "$site/_app/immutable" -type f -mtime +14 -delete 2>/dev/null || true
 # domain so the FIRST real visitor after a deploy gets cache HITs instead of slow
 # cold fetches from the (residential) origin — the post-deploy blank/slow-load cause.
 echo "  warming edge cache…"
-find "$site/_app/immutable" -type f \( -name '*.js' -o -name '*.css' \) -printf '/_app/immutable/%P\n' \
-  | xargs -P 8 -I{} curl -fsS -o /dev/null --max-time 20 "https://upbeatbytes.com{}" 2>/dev/null || true
+base="https://upbeatbytes.com"
+{
+  # every immutable chunk/asset (a superset of what index.html boots from)
+  find "$site/_app/immutable" -type f \( -name '*.js' -o -name '*.css' \) -printf '/_app/immutable/%P\n'
+  # shell + key routes + SW + version + static assets (primes CF↔origin even where
+  # no-cache; caches the cacheable ones)
+  printf '%s\n' / /play /account /admin /service-worker.js /_app/version.json \
+    /manifest.webmanifest /words-5.json /words-6.json /logo.svg /favicon.svg \
+    /icon-192.png /icon-512.png /fonts/inter-latin-wght-normal.woff2
+} | xargs -P 8 -I{} curl -fsS -o /dev/null --max-time 20 "$base{}" 2>/dev/null || true