fix: set crossOrigin on new Image() loads in assets.js and guide.js

When /assets/ is served from a separate origin (CDN/object storage),
images loaded via new Image() are not CORS-approved, tainting canvases
and breaking WebGL textures (empty map, white 3D board).

public/js/assets.js

@@ -417,6 +417,7 @@ export function loadImageElement(url) {
     if (typeof Image === 'undefined') { reject(new Error('no Image in this environment')); return; }
     const img = new Image();
     img.decoding = 'async';
+    img.crossOrigin = 'anonymous';
     img.onload = () => resolve(img);
     img.onerror = () => reject(new Error(`image failed: ${url}`));
     img.src = url;

public/js/ui/guide.js

@@ -67,6 +67,7 @@ function preload(url) {
   if (!url || typeof Image === 'undefined') return;
   const img = new Image();
   img.decoding = 'async';
+  img.crossOrigin = 'anonymous';
   img.src = url;
 }