Explicit login page: /login provider choice (X/IG), /test gate -> /login, anon opt-out removed, IG flow via identity cookie

Auth-before-test: identity cookie, /test auth gate, supersede old results, anon opt-out

Iter 4: result snapshot bugfix, favicon, /stats dashboard, /how page ...

- BUGFIX: /api/result now returns categories/calibrated/total_time_s —
  score snapshot stored in new score_json column (auto-migration),
  old rows degrade gracefully
- favicon.svg (brutalist V mark) linked on all pages
- /stats: live dashboard (starts, signed results, avg IQ, integrity line)
- /how: 'How verification works' — Ed25519 explainer for skeptics with
  offline-verify snippet and honest-limits section
- live-verified: all pages 200, full cycle + OG PNG + scoring tests pass