fix(analysis): exclude suspect runs from every average, not just attenuation

Review finding, and it was right. The PR claimed that runs with impossible
readings were "excluded from the averages". That was only true of the
attenuation average. Run 12's bad final gravity was still poisoning three
other statistics:

- **Brew time** - its 56 days were folded into the average, making a
  typical brew look like 13.7 days when it is 10.9.
- **Time to 1.010** - its 56 days did the same to that figure (8.4d).
- **The history page's ABV** - an 18.64% ABV, which made run 12 the
  "strongest" beer in the history and pulled the average up.
- **The fermentation curve** - its curve plunges from 1.042 to 0.900, which
  dragged the median line down and stretched the min-max envelope to cover
  a gravity below water.

One bad reading was reaching four different statistics.

What changed
------------
- The suspect runs are computed once and excluded from every aggregate:
  the attenuation, brew-time and time-to-1.010 averages, the fastest and
  slowest brews, the history page's ABV average, and its strongest and
  lightest.
- `/api/runs` now carries a `suspect` flag, and the charts skip the flagged
  runs - the attenuation chart and the fermentation curve.
- The suspect run stays in the table, with a "not counted" chip and a tinted
  row, so it can be corrected.  It is excluded from the figures, not
  hidden.  The card header says "16 brews (15 counted)" and the prose says
  how many brews the figures are based on.

Tests
-----
133 (up from 127).  New coverage: the suspect run is excluded from the brew
time and time-to-1.010 averages, it is still listed for review, it is
flagged in the API, it is not the strongest brew in the history, and the
charts filter it out.

The `logged_in` fixture moved to conftest.py, where both test modules can
use it.

src/flask/static/js/charts.js

@@ -305,8 +305,12 @@
         fetch("/api/runs", { headers: { "Accept": "application/json" } })
             .then(function (r) { return r.json(); })
             .then(function (runs) {
+                // A run with an impossible reading has no attenuation, and
+                // is flagged as suspect.  Both are excluded, so one bad
+                // reading cannot become a bar in the chart.
                 var done = runs.filter(function (r) {
-                    return r.attenuation !== null && r.attenuation !== undefined;
+                    return !r.suspect &&
+                        r.attenuation !== null && r.attenuation !== undefined;
                 });
                 if (!done.length) { return; }
 
@@ -383,8 +387,11 @@
         fetch("/api/runs", { headers: { "Accept": "application/json" } })
             .then(function (r) { return r.json(); })
             .then(function (runs) {
+                // A run with an impossible reading has a broken curve - it
+                // plunges to a gravity below water - which would drag the
+                // median line down and stretch the envelope to cover it.
                 var withCurve = runs.filter(function (r) {
-                    return r.curve && r.curve.length > 1;
+                    return !r.suspect && r.curve && r.curve.length > 1;
                 });
                 if (!withCurve.length) { return; }