refactor(stats): 'Web / unsynced' bucket label → 'Web'; analytics tests isolated from the live reader

The bucket name read as confusing — 'unsynced' implied data loss when
the push is always captured; it only lacks a device credential. The
bucket is just 'Web' now (service fallback, stats.ts fallback, panel
copy, tests).

Also: analytics_test exact-zero assertions (EmptyHistory,
NoReadingHistory) ran against testuser, which is a LIVE reader — real
sessions accrued on it mid-suite and both flapped. They now run under
the fresh regular user, like the stats tests; the 'testuser is a live
reader' rule is recorded in AGENTS.md.

templates/stats.templ

@@ -77,7 +77,7 @@ templ Stats(user User) {
 					</div>
 					<div class="card p-6">
 						<h3 class="text-sm font-semibold uppercase tracking-wide mb-4" style="color: var(--text-secondary)">By Device</h3>
-						<p class="text-xs mb-3" style="color: var(--text-secondary)">Where the sync pushes came from — registered device names, or "Web / unsynced" when the push carried no device credential.</p>
+						<p class="text-xs mb-3" style="color: var(--text-secondary)">Where the sync pushes came from — registered device names, plus a Web bucket for pushes that carry no device credential (the web reader).</p>
 						<div id="stats-device-breakdown" class="space-y-3">
 							<div class="text-center py-6 text-sm" style="color: var(--text-secondary)">Loading…</div>
 						</div>