refactor(stats): 'Web / unsynced' bucket label → 'Web'; analytics tests isolated from the live reader

The bucket name read as confusing — 'unsynced' implied data loss when
the push is always captured; it only lacks a device credential. The
bucket is just 'Web' now (service fallback, stats.ts fallback, panel
copy, tests).

Also: analytics_test exact-zero assertions (EmptyHistory,
NoReadingHistory) ran against testuser, which is a LIVE reader — real
sessions accrued on it mid-suite and both flapped. They now run under
the fresh regular user, like the stats tests; the 'testuser is a live
reader' rule is recorded in AGENTS.md.

internal/services/statistics_service.go

@@ -115,8 +115,8 @@ type LibraryStats struct {
 }
 
 type DeviceStats struct {
-	// DeviceID is empty for the unattributed bucket (web reader pushes
-	// that carry no device credential) — Name then reads "Web / unsynced".
+	// DeviceID is empty for the web bucket (pushes that carry no device
+	// credential — browser reading sessions) — Name then reads "Web".
 	DeviceID string `json:"device_id"`
 	Name     string `json:"name"`
 	Type     string `json:"type"`
@@ -410,8 +410,8 @@ func (s *StatisticsService) UserSummary(ctx context.Context, userID pgtype.UUID,
 				Pages:    int(row.TotalPages),
 				Sessions: int(row.SessionCount),
 				Books:    int(row.BookCount),
-				Name:     "Web / unsynced",
-				Type:     "unattributed",
+				Name:     "Web",
+				Type:     "web",
 			}
 			if row.DeviceName.Valid && row.DeviceName.String != "" {
 				entry.Name = row.DeviceName.String