SW: mutable no-cache files bypass the SW cache (Codex audit) + beacon build id

Codex's finding: cache-as-you-go would pin files Caddy deliberately serves
no-cache (version.json, manifest, word lists, icons) in the SW cache until the
next SW version — silently defeating the revalidate policy for controlled
clients. version.json is the critical one (it's how the app detects a fresh
deploy); stale word lists could drift from the server's validated answer pool.
New isMutablePath() exclusion: the SW steps aside and the browser HTTP cache
revalidates these per their headers.

Telemetry polish (also Codex): the boot beacon now fills the app_version
column with the entry chunk's hashed filename scraped from the shell's own
modulepreload link (no extra fetch) — deploy-correlated load errors become
obvious. Admin list returns + shows it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/app.html

@@ -42,8 +42,13 @@
         function report(reason) {
           if (sent) return; sent = true;             // one beacon per page
           try {
+            // The entry chunk's hashed filename identifies the build this page
+            // booted from — lets deploy-related errors correlate to a version.
+            var ver = '';
+            var pre = document.querySelector('link[rel="modulepreload"]');
+            if (pre) ver = (pre.getAttribute('href') || '').split('/').pop().slice(0, 60);
             var b = new Blob([JSON.stringify({ reason: String(reason || 'unknown').slice(0, 500),
-                                               path: location.pathname })], { type: 'application/json' });
+                                               path: location.pathname, version: ver })], { type: 'application/json' });
             navigator.sendBeacon && navigator.sendBeacon('/api/client-error', b);
           } catch (e) { /* best-effort telemetry */ }
         }