convey: load app.js in <head> to fix AppServices-undefined on /app/settings
Regression from d7f5b18a (convey: promote escapeHtml + renderMarkdown
to AppServices): per-app workspace inlines run
`const escapeHtml = window.AppServices.escapeHtml;` at top level, but
`app.js` was loaded from the body — after the workspace include — so
AppServices was undefined when those inlines parsed. The TypeError
aborted the rest of the inline, most visibly breaking the settings
nav. Moving the single `<script src=".../app.js">` tag into `<head>`
right after `api.js` defeats the parse-order bug for all 9 affected
apps (settings, sol, graph, search, import, activities, speakers,
transcripts, tokens) without touching any workspace template.
The api.js `getEscapeHtml()` fallback stays as belt-and-suspenders.
marked and dompurify remain in the body immediately before the
chat-bar IIFE; they're only needed by AppServices.renderMarkdown,
not at app.js parse time.
make ci + make verify-browser (19 scenarios incl. settings/smoke)
both green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>