server: read the verdict from where the schema puts it

Every uploaded run showed "not recorded" in the web UI because the meta
extractor read summary.verdict. Schema §7.3 calls that field
summary.overall; "verdict" is the per-category field one level down. So
the verdict was never stored, and the UI faithfully reported a gap that
was this parser's doing rather than the document's.

The test encoded the same mistake — its fixture posted
summary.verdict:"warn" — so it passed throughout against a parser that
read a field nothing writes. Corrected to summary.overall, and to a
verdict that exists: §7.3 defines green|yellow|red|inconclusive, and
"warn" was never one of them.

The eleven runs already stored had their meta backfilled from the
documents, which are kept byte-for-byte and still carry the real value.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/runs/runs_test.go

@@ -17,7 +17,7 @@ import (
 func doc(id, anon string) []byte {
 	return []byte(fmt.Sprintf(
 		`{"run":{"id":%q,"started_at":"2026-08-01T10:00:00Z","privacy":{"anonymization":%q}},`+
-			`"findings":[{"id":"f1"},{"id":"f2"}],"summary":{"verdict":"warn"}}`, id, anon))
+			`"findings":[{"id":"f1"},{"id":"f2"}],"summary":{"overall":"yellow"}}`, id, anon))
 }
 
 func open(t *testing.T, p Policy) (*Store, string) {
@@ -193,7 +193,7 @@ func TestMetaSummarisesTheDocument(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if m.FindingCount != 2 || m.Verdict != "warn" || m.Anonymization != AnonBalanced {
+	if m.FindingCount != 2 || m.Verdict != "yellow" || m.Anonymization != AnonBalanced {
 		t.Fatalf("meta not extracted: %+v", m)
 	}
 	if m.StartedAt != "2026-08-01T10:00:00Z" {