fix(phys_org): address review findings for #74

[QianhuiWu]

Context

This is the reviewed replacement for #74. The original source branch is owned by jackjin1997; GitHub returned HTTP 403 when the completed changes were pushed there, so the verified commit is published from this fork.

Changes

• Merge current main while retaining both IKEA and Phys.org, assign Phys.org to port 40017, and update all 18-site documentation and control-plane declarations.
• Replace generated journals, institutions, authors, DOI values, and article-body filler with source-derived text and source-verified metadata. Unknown source fields remain blank, and tracked provenance is recorded in sites/phys_org/source_metadata.json.
• Add Latest and Members routes, make public profiles discoverable, correct homepage links and featured layout, reduce mobile page length, and remove list-page date leakage used by comparison tasks.
• Require CSRF-protected POST logout, reject unsafe redirect targets, validate saved-note length at both HTML and server layers, and retain cross-article reply validation.
• Redesign all affected tasks to avoid first-result shortcuts and prompt-supplied answers while preserving the full 18-task scope.
• Harden all Phys.org verifiers with exact task identity, non-empty answers, same-origin ordered navigation, actual click transitions, submitted credentials/forms, answer binding, and exact state-difference checks.
• Add positive, negative, adversarial, data-quality, provenance, ranking, asset, and false-negative regression coverage.

Asset

• Hugging Face asset PR: https://huggingface.co/datasets/ChilleD/WebHarbor/discussions/52
• Immutable asset revision pinned by this PR: c0053deaf15d082bf90a94d42532b891d4ad216a
• Uploaded and re-downloaded phys_org.tar.gz SHA-256: 4e3c4b73bc2088e5ca733fd88d8b965570eac31fd7161dd98e2c795c5b5e9330
• Seed database SHA-256: 00a6878071aec3e8db8cb185c292efedf62a31a7d57b10577cb96b9c14506449

Validation

• Phys.org regression suite: 24 tests passed.
• IKEA merge regression suite: 119 tests passed.
• Python compilation, shell syntax, staged diff checks, and targeted Ruff checks passed.
• Docker release-candidate image built successfully: sha256:ab187b6efacd119a18c81922faa167791b06ad2202509ab0680d8aae90b7d7b5.
• All 18 sites returned HTTP 200; control-plane health reported 18/18 alive.
• reset-all reported 18/18 ready, and every runtime database matched its seed SHA-256 after reset.
• All 18 Phys.org tasks completed through Playwright with 98 step screenshots; all 18 corresponding deterministic verifiers passed against the resulting trajectories and before/after databases.
• Public and authenticated responsive checks passed at 320, 390, 768, and 1440 pixels with no horizontal overflow.
• CSRF, POST logout, unsafe redirects, oversized notes, cross-article replies, output escaping, source-panel omission, and DOI-link handling were exercised successfully.