M2 polish: snippet hardening + one contract note

[aharlap]

Track-as-issue items from the Milestone 2 final review (none blocking):

• Negative CORS test: assert /admin/* responses carry no Access-Control-Allow-Origin (guards the /xapi/* middleware scope against glob-broadening regressions)
• Test: token identity mode must NOT mint/store a proof:device id (pins a privacy-relevant guarantee that's currently implicit)
• test:watch doesn't chain build:snippet — stale-bundle dev footgun; chain it or document it
• embed.md: add one sentence that the snippet <script> tag must precede any inline proof.* calls (synchronous-load ordering)

Contract note (deliberate decision, recorded for M3): step/question statements store their child IRI (<activityIri>/steps/<id>, .../questions/<id>) in statements.activity_iri AND create a pseudo-activity row in activities per distinct child. The M3 dashboard must filter/namespace by the /steps/|/questions/ path segment when listing activities, and can parse child IRIs back to step/question ids for the funnel. This shape is frozen with the public snippet wire format.

🤖 Generated with Claude Code

[aharlap]

Swept in M4 Task 2: CORS negative test (/admin/keys carries no ACAO header) and the token-mode no-proof:device test are now in. Remaining (non-blocking): chain build:snippet into test:watch, and the embed.md snippet-ordering sentence.