feat: add security headers + SSL Labs checks; compact layout

- checker.js: checkSecurityHeaders() graded A+-F, checkSSL() via SSL Labs API
- Both run in parallel with sitespeed.io to minimise wait time
- DB: auto-migrate headers_json + ssl_json columns
- Layout: coach scores + CWV side-by-side, headers + SSL below
- Scorecard + CWV made compact

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/results.pug

@@ -1,7 +1,7 @@
 extends layout
 
 block content
-  div(class='space-y-6')
+  div(class='space-y-5')
     //- Header
     div(class='flex flex-wrap items-start justify-between gap-4')
       div
@@ -15,11 +15,15 @@ block content
         if reportUrl
           a(href=reportUrl target='_blank' class='text-sm bg-green-600 text-white px-4 py-1.5 rounded hover:bg-green-700') Full Report ↗
 
-    //- Coach Scores
-    include partials/scorecard
+    //- Coach Scores + Core Web Vitals side by side
+    div(class='grid grid-cols-1 md:grid-cols-2 gap-4')
+      include partials/scorecard
+      include partials/cwv
 
-    //- Core Web Vitals
-    include partials/cwv
+    //- Security Headers + SSL side by side
+    div(class='grid grid-cols-1 md:grid-cols-2 gap-4')
+      include partials/headers
+      include partials/ssl
 
     //- Navigation Timings
     include partials/timings