Keep the station screen up through restarts

Operator stations recover on their own after restarts, updates and network drops, and a scanner can no longer submit a prompt by accident.

• Fixed the station window reopening while the station was shutting down, and kept retrying the native window after a browser fallback instead of stopping after one try
• Fixed scanner input submitting a prompt while a field was still loading or right after tapping a choice
• Improved recovery after a CLI restart: fields that failed to load retry when the station reconnects, a field error stays in its own box instead of blanking the page, and the screen no longer reloads while the CLI is down
• Fixed the station serving files through links that point outside the image types it allows