fix(sacred-valley): review polish — render-gen guard, auth-boundary tests, PNG sig, dedup note

Addresses final-review findings: I1 render-generation guard prevents a double-mount
/timer leak on rapid re-navigation; I2 adds anonymous-rejection tests for the owner-only
POST /speedtest/run and /health/check; M1 CSS comment; M2 cron↔worker dedup note;
M4 full 8-byte PNG signature check; M5 card-contract unit test for all 7 cards.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/health/icons.js

@@ -16,7 +16,8 @@ async function defaultFetcher(slug) {
   return Buffer.from(await res.arrayBuffer());
 }
 
-function isPng(buf) { return buf && buf.length > 8 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47; }
+const PNG_SIG = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+function isPng(buf) { return buf && buf.length > 8 && PNG_SIG.every((b, i) => buf[i] === b); }
 
 // Returns a Buffer (cached or freshly fetched) or null if upstream has no icon.
 export async function getIcon(slug) {