fix: address PR review — error logging, ACL check, fetch error handling

- Log failures in protectBackupDir() and protectWebAccessibleDir() instead
  of silently suppressing with @ (security-critical .htaccess writes)
- Add error_log() to empty catch blocks in boot() and syncMenuIcons()
- Add core.manage ACL check to checkDir() AJAX endpoint
- Surface opendir() failures in browseDir() with warning message
- Add HTTP status check (r.ok) to JS fetch calls before parsing JSON
- Log temp SQL file deletion failures in SteppedBackupEngine

source/script.php

@@ -243,7 +243,7 @@ class Pkg_MokoJoomBackupInstallerScript
 			$db->setQuery($query);
 			$db->execute();
 		} catch (\Throwable $e) {
-			// Non-critical
+			error_log('MokoJoomBackup: syncMenuIcons() failed: ' . $e->getMessage());
 		}
 	}