SW: mutable no-cache files bypass the SW cache (Codex audit) + beacon build id

Codex's finding: cache-as-you-go would pin files Caddy deliberately serves
no-cache (version.json, manifest, word lists, icons) in the SW cache until the
next SW version — silently defeating the revalidate policy for controlled
clients. version.json is the critical one (it's how the app detects a fresh
deploy); stale word lists could drift from the server's validated answer pool.
New isMutablePath() exclusion: the SW steps aside and the browser HTTP cache
revalidates these per their headers.

Telemetry polish (also Codex): the boot beacon now fills the app_version
column with the entry chunk's hashed filename scraped from the shell's own
modulepreload link (no extra fetch) — deploy-correlated load errors become
obvious. Admin list returns + shows it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

goodnews/api.py

@@ -959,7 +959,7 @@ def create_app() -> FastAPI:
         with get_conn() as conn:
             _require_admin(conn, request)
             rows = conn.execute(
-                "SELECT reason, path, user_agent, created_at FROM client_errors ORDER BY id DESC LIMIT 20"
+                "SELECT reason, path, user_agent, app_version, created_at FROM client_errors ORDER BY id DESC LIMIT 20"
             ).fetchall()
             # Bots stay visible in the list (tagged) but are excluded from the
             # headline counts — see queries.admin_stats.