Claim buttons on result page + scoring unit tests ...

- result.html/result.js: Claim via X / Instagram buttons wired to
  /auth/{x,ig}/start, graceful 503 hint until apps are registered
- scripts/test_scoring.py: 17 unit tests (raw_score, sanity_check bot
  flags, IQ bounds, percentile extremes, categories, calibration
  fallback) — all passing