M3b prep: date handling, LIKE escaping, dashboard test polish

[aharlap]

Forward-looking items from the M3a final review, to land with or before M3b (funnel, learner detail, admin UI, exports, axe rig):

• Timestamp comparison format mismatch (attemptsPerDay, src/storage/d1.ts): stored timestamps are ISO (2026-07-03T14:00:00Z) but datetime('now','-30 days') yields space-separated strings; T > space in string comparison makes the window boundary fuzzy by up to ~1 day. Cosmetic for the 30-day chart, but M3b's funnel/CSV date filters must compare against an ISO cutoff (e.g. strftime('%Y-%m-%dT%H:%M:%fZ','now',?)) or normalize stored timestamps.
• LIKE metacharacter escaping (listRoster ${iri}/% pattern): an activity IRI containing % or _ could over-match within its own namespace read. Rare for URLs; add an ESCAPE clause when touching this query.
• Assert the MM-DD bar date label (d.day.slice(5)) in a dashboard test.
• Hoist the ADMIN auth-header const from test/dashboard.test.ts to test/helpers.ts when a second dashboard test file appears.

Done in M3a already: aria-hidden="true" on the decorative chart bar fill (final-review recommendation, committed directly).

🤖 Generated with Claude Code

[aharlap]

Swept across M3b/M4: ISO timestamp cutoffs and LIKE ESCAPE hardening (M3b Task 1), ADMIN const hoisted to test/helpers.ts (M3b Task 2). Remaining (non-blocking): assert the MM-DD bar date label.