fix: triple-tap exit, update banner auto-dismiss, .env overwrite bug

- Triple-tap exit zone now covers full header height (was 6px, untappable)
- Uses touchend event instead of click for reliable tablet interaction
- JS bridge registered once before loadUrl (not on every page load)
- Update banner auto-dismisses after 3 seconds
- CRITICAL: _finishSetup() no longer sends empty strings to save_settings
  → was overwriting .env values (Gemini key, Bring credentials) with blanks
  → now only sends non-empty values to the API

assets/js/app.js

@@ -9987,13 +9987,15 @@ async function _finishSetup() {
     if (_setupData.bring_password) s.bring_password = _setupData.bring_password;
     saveSettingsToStorage(s);
 
-    // Save server-side settings (.env)
+    // Save server-side settings (.env) — only send non-empty values to avoid overwriting existing config
+    const envPayload = {};
+    if (_setupData.gemini_key) envPayload.gemini_key = _setupData.gemini_key;
+    if (_setupData.bring_email) envPayload.bring_email = _setupData.bring_email;
+    if (_setupData.bring_password) envPayload.bring_password = _setupData.bring_password;
     try {
-        await api('save_settings', {}, 'POST', {
-            gemini_key: _setupData.gemini_key,
-            bring_email: _setupData.bring_email,
-            bring_password: _setupData.bring_password
-        });
+        if (Object.keys(envPayload).length > 0) {
+            await api('save_settings', {}, 'POST', envPayload);
+        }
     } catch(e) { /* will work locally */ }
 
     localStorage.setItem('evershelf_setup_done', '1');