fix: make the app actually usable on a phone

The worst of it: the ghost-log HUD is a fixed 300px panel pinned bottom-left
on every route. On a 390px screen it covered the seance ask-field and its
buttons outright — you could not reach the input to type a question. It now
collapses, and spans the width instead of blocking it under 560px.

- 16 uses of `100vh` meant every page was taller than iOS Safari's visible
  viewport, hiding the last row behind the toolbar. Now `100dvh` with the
  `100vh` line kept first as the fallback.
- Six inputs under 16px triggered iOS zoom-on-focus, which never zooms back
  out — you were left panning a zoomed layout after tapping login. All six
  at 16px, plus a global floor.
- No safe-area insets existed anywhere, so enabling viewport-fit=cover
  would have put content under the notch and home indicator. Added,
  including the fixed-position shells that ignore body padding.
- The codex voice table forced horizontal page scroll; it scrolls in its
  own container now.
- Tap targets under 44px raised, including a transcript replay button that
  was ~20x14px and named only by a `title` tooltip, which touch never shows.

Decorative micro-labels left alone deliberately — bumping them wholesale
would reintroduce the overflow this fixes.

README: the documented test command cannot work. conftest APPENDS `_test`,
so the documented DATABASE_URL derived `quantumancy_test_test` and errored
every test at setup. Corrected, with the two guards explained. Test counts
were stale (328/366 -> 403/385).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -351,18 +351,33 @@ One WebSocket per contact session: `/ws/session`, authenticated by the
 
 ## Testing
 
-**Backend** — pytest, **328 tests**. Requires `quantumancy_test` (dropped
-and recreated every run — never run two suites concurrently against it; the
-autouse drop/create fixture will fight itself):
+**Backend** — pytest, **400 tests**. Pass your NORMAL `DATABASE_URL`;
+`tests/conftest.py` derives the test database itself by appending `_test` to
+the name, so the command below creates and uses `quantumancy_test`. That
+database is dropped and recreated every run — never run two suites
+concurrently against it; the autouse drop/create fixture will fight itself.
 
 ```bash
 cd backend && source venv/bin/activate
-DATABASE_URL=postgresql+asyncpg://quantumancy:quantumancy@localhost:5432/quantumancy_test \
+DATABASE_URL=postgresql+asyncpg://quantumancy:quantumancy@localhost:5432/quantumancy \
 OLLAMA_BASE_URL=http://10.30.20.107:11434 \
 python -m pytest -q
 ```
 
-**Frontend** — Vitest + Testing Library, **366 tests**, plus a hard i18n
+Do **not** point `DATABASE_URL` at `quantumancy_test` here — the suffix is
+appended, not checked for, so you would get `quantumancy_test_test`, which
+does not exist, and all 400 tests error at setup. To use a database that
+isn't `<your db>_test`, set `TEST_DATABASE_URL` explicitly instead; its name
+must still end in `_test`.
+
+Two guards in `conftest.py` make it safe to name the live database here: the
+derived URL must differ from `DATABASE_URL`, **and** the derived database
+name must end in `_test`. The second exists because the first alone is
+defeated by `localhost` vs `127.0.0.1` addressing the same database. This
+matters — an early version of the suite ran `drop_all` against production
+and destroyed live séance data.
+
+**Frontend** — Vitest + Testing Library, **385 tests**, plus a hard i18n
 en/es parity gate (`npm run pretest`):
 
 ```bash