feat: enforce training safety presentation

[gronbow]

Summary

• add a deterministic safety-presentation layer so final readiness controls AI insight, recovery guidance, and training-plan permission language
• fail closed for unknown, malformed, inherited, or prototype-polluted readiness inputs
• preserve objective health values and completed activities while neutralizing training guidance for data_insufficient and stop_refer
• add visible plan states, ARIA alert/status behavior, async insight-race protection, and updated synthetic screenshots/documentation

Why

The renderer previously displayed raw insight, permissive recovery labels, and plan details independently of the normalized readiness state. A snapshot could therefore show “数据不足” while still showing “可进行较高负荷” or an executable plan. This PR makes readiness the single presentation authority without adding medical thresholds.

User impact

• data_insufficient: keeps objective data visible, labels device recovery as reference-only, hides plan load/details, and shows “待确认”
• stop_refer: stops training guidance, marks the original plan “已暂停”, and uses assertive accessibility semantics
• ready: preserves current insight, recovery, and plan presentation
• late insight success/failure callbacks cannot overwrite a newer blocked safety state

Safety and privacy

• all test snapshots and screenshots are synthetic
• no COROS credentials, tokens, coordinates, internal activity IDs, raw MCP responses, or personal health records are included
• no medical diagnosis or new physiological threshold is introduced
• smoke-only attribute assertions are disabled in packaged builds

Validation

• npm test
• npm run test:ui
• npm run audit:dependencies — 0 vulnerabilities
• npm run audit:production — 0 vulnerabilities
• npm run audit:public
• npm run audit:history
• git diff --check
• visual QA of both updated synthetic dashboard screenshots

Scope

This is PR A only. Per-metric freshness/provenance remains planned for PR B. This PR does not merge, tag, create a GitHub Release, publish an installer/plugin, redesign refresh, or change the COROS MCP/Handoff architecture.