feat: add security headers + SSL Labs checks; compact layout

- checker.js: checkSecurityHeaders() graded A+-F, checkSSL() via SSL Labs API
- Both run in parallel with sitespeed.io to minimise wait time
- DB: auto-migrate headers_json + ssl_json columns
- Layout: coach scores + CWV side-by-side, headers + SSL below
- Scorecard + CWV made compact

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db.js

@@ -17,6 +17,13 @@ export function getDb() {
   return db;
 }
 
+function migrateSchema() {
+  // Add columns introduced after initial schema — safe to run on existing DBs
+  const add = (col, type) => { try { db.exec(`ALTER TABLE jobs ADD COLUMN ${col} ${type}`); } catch {} };
+  add('headers_json', 'TEXT');
+  add('ssl_json',     'TEXT');
+}
+
 function initSchema() {
   db.exec(`
     CREATE TABLE IF NOT EXISTS jobs (
@@ -106,6 +113,7 @@ function initSchema() {
     CREATE INDEX IF NOT EXISTS idx_jobs_created ON jobs(created_at DESC);
     CREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs(status);
   `);
+  migrateSchema();
 }
 
 export function createJob(id, url, browser, mobile, runs) {