Polish backlog: low-severity correctness & UX nits (audit)

Grouped low-severity items from the Fathom-parity audit (each is small; tracked here to avoid noise). All verified against current code.

• Realtime query uses PAGEVIEW#Z upper bound — works but semantically wrong (stats.ts:84,149)
• Realtime ignores user filters (stats.ts:76-88)
• Comparison period off-by-1ms boundary (stats.ts:1037)
• Salt: UTC-midnight rotation + per-process ephemeral secret when env unset (lib/salt.ts:18-33)
• Spam/bot referral list is static & global (no per-site/wildcard config)
• customDomain tracking option is dead/unwired
• Uptime alert channels limited (email + generic webhook only; no native Slack/SMS/Telegram)
• Single unnamed API key per site; regen destroys all
• Team invites never email the invitee
• Key/DSN rotation gated at editor, not admin
• Browser detection can leave br empty (UA-only)

Source: adversarial parity/bug audit (98 agents, 81/87 findings confirmed).