store: enable WAL journal mode

Lets an external reader (sqlite3 CLI, DB Browser, DataGrip) inspect the
database file concurrently without "database is locked" errors while
geniusrund is running. Doesn't change in-process concurrency -- queries
are already fully serialized via SetMaxOpenConns(1).

auth: fix flaky tampered-cookie tests

Both tests corrupted a signed cookie by blindly overwriting its last
character with "x", which is occasionally a no-op if that character (part
of the token's signature, so effectively randomized by the embedded
timestamp) already happened to be "x" -- silently passing without having
tampered with anything. Confirmed via 15 repeated runs (3 spurious passes)
before the fix and 30 clean runs after. flipLastChar now guarantees the
byte actually changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/store/db.go

@@ -24,7 +24,12 @@ type DB struct {
 // this is a pre-production app with no compatibility obligation to older
 // database files. Edit schema.sql directly to change the schema.
 func Open(path string) (*DB, error) {
-	sqlDB, err := sql.Open("sqlite", path+"?_pragma=foreign_keys(1)")
+	// WAL mode lets an external reader (sqlite3 CLI, DB Browser, DataGrip)
+	// inspect the file concurrently without "database is locked" errors
+	// while geniusrund is running -- the app's own queries are already
+	// fully serialized via SetMaxOpenConns(1) below, so this doesn't change
+	// in-process concurrency, only cross-process access to the same file.
+	sqlDB, err := sql.Open("sqlite", path+"?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)")
 	if err != nil {
 		return nil, fmt.Errorf("open sqlite database: %w", err)
 	}