Explicit login page: /login provider choice (X/IG), /test gate -> /login, anon opt-out removed, IG flow via identity cookie

Auth-before-test: identity cookie, /test auth gate, supersede old results, anon opt-out

verify page: Claim via X button for unclaimed results

VerIQ v1 MVP: FastAPI backend, 40-task bank, frontend, Ed25519 signing ...

- backend: main.py (API + sessions + rate limit), scoring.py (weighted
  z-score normalization, sanity checks), signing.py (Ed25519 canonical
  payload signing), db.py (SQLite WAL, results + events)
- content: questions.json v1.0.0 (40 original tasks, 4 categories,
  SVG figures), calibration.json placeholder
- frontend: brutalist dark theme, test engine with timer/resume,
  result page with share links, public verify page
- docs: SPEC.md (product + tech spec, milestones)
- smoke-tested: full cycle start->finish->verify, tamper rejection OK