Add CA hash sidecar for onboarding

pikit-web/onboarding/index.html

@@ -108,13 +108,45 @@
           if (el) el.textContent = cmd;
         });
 
-        async function loadCaHash() {
+        async function fetchText(url) {
+          const res = await fetch(url, { cache: "no-store" });
+          if (!res.ok) return "";
+          return (await res.text()).trim();
+        }
+
+        async function fetchCaHashFromApi() {
+          const res = await fetch("/api/firstboot", { cache: "no-store" });
+          if (!res.ok) return "";
+          const data = await res.json();
+          return data?.ca_hash || "";
+        }
+
+        async function loadCaHash(retries = 10) {
           if (!caHash) return;
           try {
-            const res = await fetch("/api/firstboot");
-            const data = await res.json();
-            caHash.textContent = data?.ca_hash || "Unavailable";
+            const assetHash = await fetchText("/assets/pikit-ca.sha256");
+            if (assetHash) {
+              caHash.textContent = assetHash.split(/\s+/)[0];
+              return;
+            }
           } catch (err) {
+            // ignore and try API
+          }
+
+          try {
+            const apiHash = await fetchCaHashFromApi();
+            if (apiHash) {
+              caHash.textContent = apiHash;
+              return;
+            }
+          } catch (err) {
+            // fall through
+          }
+
+          if (retries > 0) {
+            caHash.textContent = "Generating...";
+            setTimeout(() => loadCaHash(retries - 1), 2000);
+          } else {
             caHash.textContent = "Unavailable";
           }
         }