fix(sacred-valley): review polish — render-gen guard, auth-boundary tests, PNG sig, dedup note

Addresses final-review findings: I1 render-generation guard prevents a double-mount
/timer leak on rapid re-navigation; I2 adds anonymous-rejection tests for the owner-only
POST /speedtest/run and /health/check; M1 CSS comment; M2 cron↔worker dedup note;
M4 full 8-byte PNG signature check; M5 card-contract unit test for all 7 cards.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/cron/index.js

@@ -23,6 +23,10 @@ export function startCron() {
     catch (e) { log.error({ err: e }, 'cron speedtest failed'); }
   });
 
+  // Health checks every minute. NOTE: this runs checkAll() inline; the same
+  // probe+upsert logic is also exposed on-demand via the `health.check` pg-boss
+  // worker (lib/jobs/workers/health_check.js, triggered by POST /api/health/check).
+  // Keep the two in sync — both rely on lib/health/checker.js as the source of truth.
   cron.schedule('*/1 * * * *', async () => {
     try {
       const results = await checkAll(load());