refactor(stats): 'Web / unsynced' bucket label → 'Web'; analytics tests isolated from the live reader

The bucket name read as confusing — 'unsynced' implied data loss when
the push is always captured; it only lacks a device credential. The
bucket is just 'Web' now (service fallback, stats.ts fallback, panel
copy, tests).

Also: analytics_test exact-zero assertions (EmptyHistory,
NoReadingHistory) ran against testuser, which is a LIVE reader — real
sessions accrued on it mid-suite and both flapped. They now run under
the fresh regular user, like the stats tests; the 'testuser is a live
reader' rule is recorded in AGENTS.md.

web/src/stats.ts

@@ -254,7 +254,7 @@ function renderDevices(rows: DeviceRow[]): void {
   const container = document.getElementById("stats-device-breakdown");
   if (!container) return;
   renderBars(container, rows.map((r) => ({
-    label: r.name || "Web / unsynced",
+    label: r.name || "Web",
     sub: `${r.books} ${r.books === 1 ? "book" : "books"} · ${r.sessions} sessions`,
     minutes: r.minutes,
   })));