refactor(stats): 'Web / unsynced' bucket label → 'Web'; analytics tests isolated from the live reader

The bucket name read as confusing — 'unsynced' implied data loss when
the push is always captured; it only lacks a device credential. The
bucket is just 'Web' now (service fallback, stats.ts fallback, panel
copy, tests).

Also: analytics_test exact-zero assertions (EmptyHistory,
NoReadingHistory) ran against testuser, which is a LIVE reader — real
sessions accrued on it mid-suite and both flapped. They now run under
the fresh regular user, like the stats tests; the 'testuser is a live
reader' rule is recorded in AGENTS.md.

AGENTS.md

@@ -46,6 +46,14 @@ were name-only across ALL libraries. Fixed; do not regress.
   renamed admin escapes the cleanup preserve-list and cascades real
   data (this wiped the dev annotations once; see user_test.go
   TestUpdateProfileSelfEdit for the dedicated-user pattern).
+- **`testuser` is a LIVE reader**: the dev account genuinely reads in
+  the web reader while the suite runs, so `reading_history` /
+  `reading_progress` rows accrue on it mid-test. Exact-total
+  assertions against that account flap (three stats/analytics tests
+  broke on 2026-10-14 within hours of session capture shipping).
+  Tests that need deterministic data use `setup.RegularToken` +
+  `getRegularUserID` (the fresh per-test user), or assert ranges
+  instead of equals.
 
 ## Timezones