feat(ui): rebuild the interface with a proper design system

The old UI was two pages of raw pandas tables with no navigation, no styling
and no way to see a run's comments. This replaces it with a small,
testable application and a beer-themed design.

What changed
------------

Restructure
- The domain logic now lives in `brewing.py` as pure functions over plain
  data, with no Flask or Mongo dependency. The gravity maths, the ABV
  formula and the run-aggregation rules are unit-testable on their own.
- `app_factory.py` replaces the module-level app, and the routes move into
  blueprints under `views/`. A request-scoped Mongo repository is created per
  request and closed at teardown.
- `mongo/repository.py` replaces `build_db.py` / `query_db.py` / `get_conn.py`.
  Reading a document no longer requires a second query to fetch the fields.

Interface
- A dark, beer-themed design system: warm amber `#be7f39` on near-black, a
  condensed display face (Anton) for headings and Inter for body text. Both
  fonts and the chart library are vendored into `static/`, so the container
  needs no outbound network at runtime — the old templates pulled Bootstrap
  from a CDN.
- A real navigation bar, a login page, a brew-process page with a proper
  form, and a run-detail page listing every reading with its comment.
- The run summary tables now show the beer name and the latest comment, which
  the old pandas tables did not.
- Native form controls (checkbox, number spinners, date icon, scrollbars)
  are restyled for the dark theme.

Correctness
- The alcohol calculation now uses the standard homebrew formula,
  `(OG - FG) x 131.25`. The old code used `(max - min) / 7.36 + 0.5`, which is
  not a recognised brewing formula and overstated every result.
- Gravity points and decimal readings now convert correctly in both
  directions (`1039` <-> `1.039`).
- A run's display name resolves to the most-used label across its readings,
  because `beer_type` is stored per-reading and drifts across a run.
- Re-submitting a reading for the same run and day updates it in place
  rather than creating a duplicate.

Security / production
- The container ran the Werkzeug debugger with `FLASK_DEBUG=1`, exposing an
  interactive console on any unhandled error. It now runs waitress with
  debugging off.
- `SECRET_KEY` comes from the environment.
- The app secret is no longer a hard-coded string in source.

Housekeeping
- Removes the bokeh/duckdb/pandas dependency chain and the static file it
  generated at import time; removes the dead `add_user.py` and `test.py`.
- Splits `requirements.txt` (runtime) from `requirements-dev.txt` (tests).
- Adds a pytest suite (64 tests) and a `test` job to the CI workflow so the
  image is only built when the tests pass.
- Adds a README describing the data model and a RUNBOOK for the cluster side.

Data compatibility
------------------
The existing `beer_db.beer_data` documents are read as they are and are not
migrated or rewritten. No collection is dropped, and no document is modified
by this change other than through the explicit "record a reading" form, which
keeps the original `(date, beer_run_id)` uniqueness rule.

tests/conftest.py

@@ -0,0 +1,67 @@
+"""Shared pytest fixtures for the beer_data test suite."""
+
+from __future__ import annotations
+
+import os
+import sys
+
+import pytest
+
+# The Flask app lives in src/flask and imports its siblings by bare name
+# (``import brewing``), so that directory has to be on the path.
+APP_DIR = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+                        "src", "flask")
+if APP_DIR not in sys.path:
+    sys.path.insert(0, APP_DIR)
+
+
+@pytest.fixture()
+def mongo_client():
+    """An in-memory Mongo, shared by the repository the app builds."""
+    import mongomock
+
+    return mongomock.MongoClient()
+
+
+@pytest.fixture()
+def client(mongo_client):
+    """A Flask test client backed by an in-memory Mongo (mongomock)."""
+    from app_factory import create_app
+
+    app = create_app({
+        "TESTING": True,
+        "WTF_CSRF_ENABLED": False,
+        "SECRET_KEY": "test-secret",
+        "MONGO_CLIENT": mongo_client,
+    })
+
+    with app.test_client() as test_client:
+        yield test_client
+
+
+@pytest.fixture()
+def repo(mongo_client):
+    """A repository backed by an in-memory Mongo."""
+    from mongo.repository import BeerRepository
+
+    return BeerRepository(client=mongo_client)
+
+
+def seed_readings(repository, rows):
+    """Insert reading documents directly, bypassing the app.
+
+    Each row is ``(beer_run_id, beer_type, sg, date, final_reading, comment)``.
+    """
+    docs = []
+    for run_id, beer_type, sg, date, final, comment in rows:
+        docs.append({
+            "beer_run_id": str(run_id),
+            "beer_type": beer_type,
+            "sg": str(sg),
+            "date": date,
+            "final_reading": "True" if final else "False",
+            "comment": comment,
+        })
+    if docs:
+        repository.readings.insert_many(docs)
+    return docs