A first-party beacon reports each page's real load, LCP, INP, CLS and TTFB to the forge, keeping no IP #2711

Second part of #2674.

Done:

• [ ] one static, immutable script under 2 KB (no third party, no dependency) on every forge page, sending route, navigation timing and LCP, INP, CLS, TTFB once per page view with sendBeacon
• [ ] POST /_measure is same-origin only, validates every field (route known, numbers finite and bounded), caps body size and rate per client, answers 204
• [ ] stored in bun:sqlite with no IP and no user agent string: unique visitors are a hash with a salt that rotates daily; Do-Not-Track and an opt-out cookie send nothing
• [ ] the CSP stays as strict as today
• [ ] tests: a valid report is stored; a cross-origin, oversized or malformed one is refused; DNT stores nothing; the asset is under 2048 bytes

Files: src/web/ (asset + layout), a new module and route, a migration.

Parked by the crew: the check failed ("browsing an origin repository on the web > Mirror from a browse lands on a job page with a live checklist") and the decider saw no point in another try (pull #2731 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.