fix: final review pass — email collision, orphaned-run loop, null confidence guards

- changeEmail validates and refuses an address another account owns (users.email is UNIQUE; a collision was a 500 inside the settings form).
- /app/[id] no longer redirects a 'running' row to itself; it renders what exists and says the run was interrupted.
- ScoreBar / OptionRow / VerdictBlock survive null numbers from the model instead of throwing and losing the block (seen live: '[openui] runtime/render-error: Component ScoreBar render failed').
- drop the ad-hoc render-debug scripts now that Playwright covers the browser.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/auth.test.ts

@@ -18,3 +18,16 @@ test("token hash is stable, 64 hex", () => {
   assert.equal(hashToken("abc"), hashToken("abc"));
   assert.match(hashToken("abc"), /^[0-9a-f]{64}$/);
 });
+test("changeEmail refuses an address another account already has", async () => {
+  const { signUpNewUser, changeEmail } = await import("../lib/auth.ts");
+  const db = await import("../lib/db.ts");
+  const a = signUpNewUser("first@x.test", "0123456789ab");
+  const b = signUpNewUser("second@x.test", "0123456789ab");
+  assert.ok(a.ok && b.ok);
+  assert.deepEqual(changeEmail(b.id, "first@x.test"), { ok: false, error: "That email already has an account." });
+  assert.deepEqual(changeEmail(b.id, "not an email"), { ok: false, error: "Enter a valid email address." });
+  assert.deepEqual(changeEmail(b.id, " FIRST@X.TEST "), { ok: false, error: "That email already has an account." });
+  assert.equal(changeEmail(a.id, "first@x.test").ok, true, "own address is not a conflict");
+  assert.equal(changeEmail(b.id, "fresh@x.test").ok, true);
+  assert.equal(db.userByEmail("fresh@x.test")!.id, b.id, "stored lower-cased");
+});