fix: preloader + update notification robustness

- Add full-screen CSS preloader to webapp (fades out when _initApp completes)
- Defer _checkWebappUpdate() to 6s after app init so it does not compete
  with startup API calls (fixes perceived slowness on first load)
- Switch update-check throttle from sessionStorage to localStorage (6h TTL);
  use release published_at instead of version string for comparison, so the
  banner correctly appears when a new release is published regardless of whether
  the tag is a semver or the rolling "latest" tag
- PHP _isLatestVersion(): return true (do not suppress error reports) when
  tag_name is non-semver (e.g. "latest") — was incorrectly blocking ALL reports
- Kiosk checkForUpdates(): show banner only when the release asset actually
  contains an APK for the component; handle non-semver tag by treating it
  as always-update (prevents silent no-op with rolling "latest" tag)
- Scale gateway checkForUpdates(): same non-semver fix; apkUrl now defaults
  to empty and bails out if no matching APK found in assets (prevents 404 install)

api/index.php

@@ -5720,7 +5720,11 @@ function _isLatestVersion(string $clientVersion): bool {
     if ($clientVersion === '') return true; // unknown → allow (don't suppress)
     $latest = _latestReleaseTag();
     if ($latest === '') return true; // no release yet → allow
-    return ltrim($clientVersion, 'v') === ltrim($latest, 'v');
+    $latestNorm = ltrim($latest, 'v');
+    // If tag is not semver-like (e.g. "latest", "rolling") we can't compare
+    // meaningfully, so don't suppress error reporting.
+    if (!preg_match('/^\d+\.\d+/', $latestNorm)) return true;
+    return ltrim($clientVersion, 'v') === $latestNorm;
 }
 
 /**