fix(ui): give the dashboard its own slot so the transaction cache has one writer

[argszero]

Summary

Live.transactions — the transaction view's payload cache — had two writers:
loadTransactions (which, in the same function, also records the validity
evidence txTable.loadedPage / loadedPageSize / loadedFilterSig) and
loadDashboard (which records none of it).

renderTransactions' cache guard compares only that evidence, so the dashboard's
payload — produced by a different query (page=1&page_size=1, no time range,
fetched only to read total) — passed the guard and was rendered as if it were
the page's own. Re-entering the transaction view (renderView renders
synchronously, then fetches asynchronously) showed three contradictory things at
once:

• the table showed 1 row (page_size=1);
• the summary card was labelled "current filter" while showing the all-time
  aggregate (that request carries no range);
• the trend card claimed "trend data failed to load" — a request that was
  never sent and never failed (trend is only attached by loadTransactions).

Fix: loadDashboard keeps its number in its own slot, Live.tradeCount, so
Live.transactions is back to a single writer.

Related Issue

None — found by recon; the repository has no open issues.

Changes

• ui/js/app.js — loadDashboard stores the transaction count in the new
  Live.tradeCount slot instead of writing Live.transactions; renderDashboard
  reads that slot. Live's field table now says which of the two slots belongs to
  which view.
• src/state_gate.rs (new; test-only) — a static gate pinning slot ownership.
• src/main.rs — register the gate module under #[cfg(test)].
• ui/index.html — cache-bust app.js?v=20260915-4.
• ui/README.md — new convention section ("one slot, one writer, and the writer
  records the evidence").
• No config / data-structure changes.

Tests

• cargo test — 269 passed (was 265; +4 new gate tests)
• cargo fmt --check clean
• New unit tests added

Why a static gate and not just a DOM probe

The competing fix — make the guard also compare the payload's page_size —
turns every DOM assertion green. A probe can prove the screen no longer shows
the foreign payload; it cannot prove the cache no longer holds it. exportTxCsv
reads Live.transactions.items directly, with no guard at all, so a polluted
cache still exports the wrong row set.

Evidence (A/B)

jsdom probe: real ui/index.html + the four real scripts, only fetch stubbed,
freezing the transaction view's own request to hold the mid-state.

tree	gate (src/state_gate.rs)	DOM probe
pre-change (byte-exact, md5 f919ae82…)	red (2 of 4)	red {B1,B2,B3}, positive-control legs green
competing fix (expand the guard)	red	axis {B1,B2,B3} green
this branch	4/4 pass	9/9 pass

The gate asserts writes(Live.transactions) == {loadTransactions}, that this
equals the set of functions writing txTable.loaded*, that the dashboard still
makes its count query and keeps it in its own slot (so "just delete the request"
does not pass), and it self-checks its function-body extractor and its read/write
discrimination on synthetic input — calls, Live.transactions.items reads,
=== null comparisons and the guard's own !== comparisons must not count as
writes.

Checklist

• Branch name follows the convention (fix/)
• Commit message uses Conventional Commits
• Single responsibility, minimal change