Phase 2: AI coach reflection loop

Add the mirror-not-compass reflection layer between profile generation and
affirmation. The coach reflects the person's profile back, and only when they
explicitly correct or add something does it propose revisions in their own
direction — never prescribing goals.

- ReflectionCoach service (app/services/reflector.py): Anthropic-backed,
  returns {message, revisions, revision_note}; revisions filtered to the seven
  editable prose fields (never triad/type); one-retry JSON handling.
- Endpoints (owner-scoped, 409 when locked): POST /discovery/profile/me/reflect
  (opener + turns, applies revisions), GET .../reflection (dialogue),
  GET .../revisions (iteration history). complete records an 'extraction'
  revision; PATCH records 'manual_edit'.
- Models + migration 004: reflection_message (coach/person turns) and
  profile_revision (snapshots: extraction | reflection | manual_edit) —
  captures edits and iterations rather than overwriting.
- Frontend: reflect.html chat (coach/person bubbles, live profile summary that
  refreshes on revision, affirm); linked from profile.html.
- Affirmation remains the existing confirm/lock.

Also refresh README for Phase 2 and for the HTTPS deployment
(https://impactflow.teamci.org:8011, OAUTH_REDIRECT_URI + COOKIE_SECURE notes).

Tests: 50 passing (added reflector unit tests and reflection endpoint tests;
run in-container).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_static_discovery.py

@@ -33,6 +33,21 @@ def test_profile_page_has_edit_affordance():
     assert "Edit my words" in html
 
 
+def test_reflect_page_uses_reflection_endpoints():
+    """Phase 2 reflection page drives the coach loop via authedFetch."""
+    html = Path("app/static/reflect.html").read_text(encoding="utf-8")
+
+    assert "/discovery/profile/me/reflect" in html
+    assert "/discovery/profile/me/reflection" in html
+    assert "authedFetch" in html
+    assert "user_id" not in html
+
+
+def test_profile_page_links_to_reflection():
+    html = Path("app/static/profile.html").read_text(encoding="utf-8")
+    assert "/static/reflect.html" in html
+
+
 def test_auth_helper_sends_credentials_and_refreshes():
     js = Path("app/static/auth.js").read_text(encoding="utf-8")