CanaryAgent pricing, referral math, and endpoint hardening

- CanaryAgent added to the pricing comparison table and to the Free and Shield plan cards.
- Referral discount formula corrected (percent-off, correct for any value); landing free-tier decoy count fixed from 5 to 3.
- CanaryAgent heartbeat and skill-scan endpoints now require authentication; CanaryRAG monitoring is metered.
- Route auth-coverage test, RLS owner-policy script, and SameSite=Strict token cookies.