Status pill + git-SHA asset versioning

- _origin_probe(): 3-min check of anidb.app pages/API; OK/DOWN + reason
  in GET /api/cdn and server.log ([probe] ORIGIN ...)
- header pill: upstream-site dot (red = down) + CDN dot + label;
  per-dot hover tooltips, tap -> toast legend (mobile has no hover)
- ?v={{VERSION}} injected from 'git describe --always --dirty' at
  startup; JSV reads it from its own script URL - replaces hand-bumped
  numbers (JSV/?v drift) and gives play-probes the running commit

static/index.html

@@ -3,17 +3,22 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="theme-color" content="#0e0f13">
+<meta name="mobile-web-app-capable" content="yes">
+<meta name="apple-mobile-web-app-capable" content="yes">
 <title>ani-web</title>
-<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 64 64'%3E%3Crect width='64' height='64' rx='14' fill='%23f97316'/%3E%3Ctext x='32' y='45' font-family='sans-serif' font-size='42' font-weight='700' text-anchor='middle' fill='%230e0f13'%3Ea%3C/text%3E%3C/svg%3E">
+<link rel="icon" href="icon.svg">
+<link rel="manifest" href="manifest.webmanifest">
 
-<link rel="stylesheet" href="style.css?v=14">
+<link rel="stylesheet" href="style.css?v={{VERSION}}">
 </head>
 <body>
 <header>
   <a class="logo" href="/">ani-web</a>
   <form onsubmit="const q=document.getElementById('q').value.trim(); if(q) location='?q='+encodeURIComponent(q); return false">
-    <input id="q" placeholder="search anime…" autocomplete="off" autocapitalize="off" spellcheck="false">
+    <input id="q" placeholder="search anime…" aria-label="search anime" autocomplete="off" autocapitalize="off" spellcheck="false">
   </form>
+  <span id="pill" class="pill"><i class="o"></i><i class="c"></i><span></span></span>
   <span id="me" class="muted"></span>
   <div id="menubox" style="display:none">
     <button id="menu" class="tiny" aria-label="menu" aria-haspopup="true">☰</button>
@@ -26,10 +31,10 @@
 </header>
 <main id="main"><p class="muted">Search for an anime to get started.</p></main>
 <div id="toasts" aria-live="polite"></div>
-<!-- ponytail: bump ?v= whenever app.js/style.css change — they are cached
-     max-age=300 in browser AND possibly in your HTTPS proxy, and a stale
-     copy is exactly how users keep seeing an old UI after a deploy -->
+<!-- Versioning: ?v={{VERSION}} is replaced by the server (server/app.py index
+     route) with the git SHA at startup — a correct cache key per commit.
+     No hand-bumping; JSV in app.js reads the same value from its own URL. -->
 <script src="hls.min.js"></script>
-<script src="app.js?v=14"></script>
+<script src="app.js?v={{VERSION}}"></script>
 </body>
 </html>