feat: add security headers + SSL Labs checks; compact layout

- checker.js: checkSecurityHeaders() graded A+-F, checkSSL() via SSL Labs API
- Both run in parallel with sitespeed.io to minimise wait time
- DB: auto-migrate headers_json + ssl_json columns
- Layout: coach scores + CWV side-by-side, headers + SSL below
- Scorecard + CWV made compact

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/partials/ssl.pug

@@ -0,0 +1,27 @@
+- const ssl = job.ssl_json ? JSON.parse(job.ssl_json) : null
+- function sslColor(g) { return !g ? 'bg-gray-100 text-gray-400' : ['A+','A','A-'].includes(g) ? 'bg-green-100 text-green-700' : g === 'B' ? 'bg-yellow-100 text-yellow-700' : ['C','D'].includes(g) ? 'bg-orange-100 text-orange-700' : 'bg-red-100 text-red-700'; }
+
+div(class='bg-white border border-gray-200 rounded-xl p-5')
+  h2(class='text-base font-semibold mb-3') SSL / TLS
+  if ssl
+    div(class='flex items-start gap-5 flex-wrap')
+      div(class='flex flex-col items-center gap-1')
+        div(class=`score-circle w-14 h-14 text-lg ${sslColor(ssl.grade)}`)= ssl.grade || 'T'
+        span(class='text-xs text-gray-500') Grade
+      div(class='grid grid-cols-2 sm:grid-cols-3 gap-2 flex-1 text-sm')
+        div(class='bg-gray-50 rounded-lg px-3 py-2')
+          div(class='text-xs text-gray-400') IP Address
+          div(class='font-medium')= ssl.ipAddress || '—'
+        div(class='bg-gray-50 rounded-lg px-3 py-2')
+          div(class='text-xs text-gray-400') Cert Expires
+          div(class='font-medium')= ssl.certExpiry || '—'
+        div(class='bg-gray-50 rounded-lg px-3 py-2')
+          div(class='text-xs text-gray-400') Days Until Expiry
+          - const d = ssl.daysUntilExpiry
+          div(class=`font-medium ${d != null && d < 30 ? 'text-red-600' : d != null && d < 60 ? 'text-yellow-600' : 'text-green-700'}`)
+            = d != null ? d + ' days' : '—'
+        div(class='bg-gray-50 rounded-lg px-3 py-2 col-span-2 sm:col-span-3')
+          div(class='text-xs text-gray-400 mb-1') Protocols
+          div(class='font-medium')= ssl.protocols?.join(' · ') || '—'
+  else
+    p(class='text-sm text-gray-400 italic') Not available — HTTPS only or check timed out