x_exchange: new X token endpoint contract (client_type + client_secret in body)

OAuth phase 2: X/IG token exchange, claim_result in DB, callback redirects, hide claim buttons when claimed

Python 3.8 compatibility part 2: builtin generics -> typing generics ...

dict[str, X] / list[X] / tuple[X, Y] replaced with Dict/List/Tuple
across backend (main, oauth, scoring). Scoring tests pass.

Python 3.8 compatibility: X | None -> Optional[X] ...

Internal proxy VPS (deploy target) runs Ubuntu 20.04 / Python 3.8.
Replaced PEP 604 unions with typing.Optional across backend
(db, main, oauth, scoring, signing). Scoring tests still pass.

Iter 4: result snapshot bugfix, favicon, /stats dashboard, /how page ...

- BUGFIX: /api/result now returns categories/calibrated/total_time_s —
  score snapshot stored in new score_json column (auto-migration),
  old rows degrade gracefully
- favicon.svg (brutalist V mark) linked on all pages
- /stats: live dashboard (starts, signed results, avg IQ, integrity line)
- /how: 'How verification works' — Ed25519 explainer for skeptics with
  offline-verify snippet and honest-limits section
- live-verified: all pages 200, full cycle + OG PNG + scoring tests pass

Claim buttons on result page + scoring unit tests ...

- result.html/result.js: Claim via X / Instagram buttons wired to
  /auth/{x,ig}/start, graceful 503 hint until apps are registered
- scripts/test_scoring.py: 17 unit tests (raw_score, sanity_check bot
  flags, IQ bounds, percentile extremes, categories, calibration
  fallback) — all passing

OG cards, deploy scripts, OAuth scaffolding ...

- backend/og.py: 1200x630 PNG result cards (Pillow, brutalist dark theme, cached per result_id)
- main.py: server-rendered /result/<id> and /v/<id> with dynamic OG meta injection (fixes missing /result route), /og/<id>.png card endpoint
- backend/oauth.py: X OAuth2 PKCE + Instagram FB-Login scaffolding, 503 until apps registered; /auth/x/* and /auth/ig/* routes wired
- scripts/deploy.sh: systemd unit + nginx + certbot, idempotent
- .env.example: all runtime + OAuth config vars
- live-tested: OG meta injection, PNG generation, 404s, OAuth 503 stubs

VerIQ v1 MVP: FastAPI backend, 40-task bank, frontend, Ed25519 signing ...

- backend: main.py (API + sessions + rate limit), scoring.py (weighted
  z-score normalization, sanity checks), signing.py (Ed25519 canonical
  payload signing), db.py (SQLite WAL, results + events)
- content: questions.json v1.0.0 (40 original tasks, 4 categories,
  SVG figures), calibration.json placeholder
- frontend: brutalist dark theme, test engine with timer/resume,
  result page with share links, public verify page
- docs: SPEC.md (product + tech spec, milestones)
- smoke-tested: full cycle start->finish->verify, tamper rejection OK

Initial commit