test: pin visitor counting, questionnaire auth, and session cleanup

[cursor]

Risky behavior now covered

• Audience count (recordVisit): one person in a window is one visitor; bots do not inflate the headline number; empty user agents still count as people; unknown hosts cannot mint a site label; the tracked set stops at the cap and records that the figure is a floor; the window key is non-extractable; a new window mints a new key so the previous count cannot be joined.
• Questionnaire auth: GET/POST /questionnaire without a JWT cookie, or with a forged one, bounce to / before any session lookup. The token is not placed on Location.
• Session cleanup and storage: expired sessions are collected from updated_at (last visit), not created_at; the session INSERT never stores the opaque token or a plaintext email; completed sessions cannot be resumed.
• Delivery mailer argv: python3 is invoked with the sender and the spec path only — the recipient stays in the 0600 spec file, not on world-readable /proc/<pid>/cmdline.

CI now also runs the existing hermetic keystore, bundle-validation, and co-op QR tests that were passing locally and running nowhere.

Test files added/updated

• lib/audience_test.ts (updated) — in-memory count, bots, cap, unlinkability
• lib/audience.ts — tiny test hooks (_windowSnapshotForTest, _setMaxTrackedForTest); production path unchanged aside from reading trackedCap (defaults to MAX_TRACKED)
• routes/questionnaire_auth_test.ts (added)
• lib/questionnaire-session_test.ts (added)
• romania/tests/mailer_argv_test.ts (added)
• .github/workflows/ci.yml — runs the new files plus romania/tests/{keystore,service}_test.ts and routes/WillyStCo{op,-op}_test.ts

Why these tests materially reduce regression risk

These are the production paths every visitor and every questionnaire hit, and they were untested at the counting/auth/cleanup layer. A bot counted as a person, a cap that stopped being enforced, a forged JWT that advanced a session, a cleanup keyed off minting time, or an address on argv would all ship as silent security or privacy failures. None of this overlaps the open coverage PRs (#112 JWT/callback, #114 consent/session-keys/contact, #115 gate API/beacon/verify/wearable, #116 profile/store-bounds/metrics/gate cookies).

Hermetic: no Postgres, no SMTP, no qpdf. 122 Deno tests passed locally, including the full CI set.

No production behavior changes besides the audience cap reading an overridable binding that tests reset to MAX_TRACKED.