Spec #136: Finished belongs to the Series — owner-owned poll gate, Lifecycle bucket dropped (#163)

Closes #136.

Spec #136 end to end: `finished` becomes a fact about the Series, written only by the owner, and the reader-facing Lifecycle bucket is gone.

## What landed

- **#157** — `series.finished_at bigint NOT NULL DEFAULT 0` plus the migration whose statement order is load-bearing (seed from the buckets, then flip them); both Lane queries lose the `HAVING COUNT(*) FILTER (WHERE b.status <> 'finished')` clause and gate on `finished_at = 0` instead, with the due-query/eligible-count force asymmetry kept deliberate and commented; `StatusFinished`, its API special-case 400, the web tab and the templates' Finished bucket deleted.
- **#158** — owner Finish control on the Series detail page: confirm-gated finish, instant un-finish, admin accent (never ember, nothing is destroyed), `Store.SetSeriesFinished`, the two routes behind the owner gate, and the state displayed on the list row without offering the control there.
- **#160** — reader side: derived `finished` bool on the flat Bookmark (`s.finished_at > 0`), rendered as a text-only label in both userscripts and on the web card; read-only inbound by omission from `Upsert`'s explicit `series` column list, same mechanism that already protects `cover`.
- **#161** — glossary and the stale Reader-count divergence note catch up.
- **#159** — `finished` joins the admin filter vocabulary (predicate `finished_at > 0`, label `Finished`, own aggregate count, figure last in the stats block as informational); the four clock-driven hygiene predicates (stale, never-checked, no-cover, no-chapter) exclude finished Series while unpollable, orphan and sighting-raised deliberately do not.

## Verification

`go vet ./...` and `go test ./...` green on the merged branch (Docker-backed, throwaway `postgres:17-alpine` per package). Each ticket also passed a two-axis review (spec + standards) on its own branch before merge.

Reviewed-on: #163
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/web/admin_overview.go

@@ -24,8 +24,9 @@ type overviewView struct {
 	// its own filter, and the verdict wants the inclusive number.
 	Unchecked int
 	// Hygiene is the seven problem filters in the Series list's own render
-	// order; Library is the library split plus the roster. Every figure is a
-	// door into the list that counts it, except a zero.
+	// order plus the finished figure riding last (informational); Library is
+	// the library split plus the roster. Every figure is a door into the list
+	// that counts it, except a zero.
 	Hygiene []fig
 	Library []fig
 	// Sites is the per-Site library shape table, one row per Site with any
@@ -59,7 +60,7 @@ type siteRow struct {
 }
 
 // overviewView assembles the landing page from the store's read model: one
-// SeriesShapes pass per filter summed in Go (the shipped surface offers eight
+// SeriesShapes pass per filter summed in Go (the shipped surface offers nine
 // grouped passes, not a stats query — #140), the pass log's latest pass per
 // Site, and the roster. A failure in any read is a 500 with a logged reason,
 // never a page of silent zeroes.
@@ -93,8 +94,10 @@ func (h *Handler) overviewView() (overviewView, error) {
 	view.Unchecked = totals[store.SeriesFilterStale] + totals[store.SeriesFilterNeverChecked]
 	view.Verdict, view.HasCounts = overviewVerdict(passes, now)
 
-	// The seven problem filters, in seriesFilterOrder's permanent-then-fixable
-	// order; the All filter's count belongs to the Library block, not to a
+	// The hygiene figures, in seriesFilterOrder's tail: the seven problem
+	// filters in permanent-then-fixable order, then the finished figure last —
+	// informational, not a problem, and last because seriesFilterOrder appends
+	// it there. The All filter's count belongs to the Library block, not to a
 	// "hygiene" figure.
 	hygiene := make([]fig, 0, len(seriesFilterOrder)-1)
 	for _, name := range seriesFilterOrder[1:] {