feat(report): birth-sky report cover bound to the report's birth fingerprint (F1–F3)

Product decision A (TASK-birth-sky-followup-20260928):
- every generation path writes subject.birthFingerprint (stored-row
  fingerprint, same function as the chart page's profileFingerprint);
  never into the evidence bundle the model reads
- GET /api/reports/:id compares on the server and returns only
  report.coverSubject (subject id or null); legacy reports never get one
- report page shows the night cover above the body, paper cover alone on
  the first printed A4 page; silent on any failure, no waiting state
- TS / JSON schema / Python contract accept the optional field
- BLOCKED T5 struck through; DESIGN §17, CHANGELOG, checklist, PROGRESS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N4f2nya58RoRu4yEmJgRGE

tests/test_personal_report_contract.py

@@ -229,6 +229,19 @@ def test_strict_keys_missing_and_extra(fixture: dict) -> None:
     assert any("unexpected keys" in error for error in result.errors)
 
 
+def test_subject_birth_fingerprint_is_optional_and_pattern_checked(fixture: dict) -> None:
+    # Report cover binding (TASK-birth-sky-followup-20260928): old documents
+    # have no fingerprint; new ones carry a 32-hex stored-row fingerprint.
+    assert "birthFingerprint" not in fixture["subject"]
+    bound = json.loads(json.dumps(fixture))
+    bound["subject"]["birthFingerprint"] = "0123456789abcdef0123456789abcdef"
+    assert validate_report_document(bound).valid
+    bound["subject"]["birthFingerprint"] = "1994-05-18"
+    result = validate_report_document(bound)
+    assert not result.valid
+    assert any("subject.birthFingerprint" in str(error) for error in result.errors)
+
+
 def test_json_object_key_order_is_not_validated(fixture: dict) -> None:
     # JSON objects are unordered; fixed reader order is a display contract of
     # the typed fields, never a key-order condition.