add more stats to mobile and fix refresh stint

docs/javascript-architecture.md

@@ -195,7 +195,8 @@ Owns:
 - strict per-class lap filtering and aggregate statistics
 - sanitized branding plus class-specific goals and recommendation response
 - server-side visibility filtering for progress, achievements, performance/stints, goals, and history
-- bounded class-specific pace history and recent stint summaries for the mobile profile
+- bounded class-specific pace history, active 30-minute pace buckets, and recent stint summaries for the mobile profile
+- token-, profile-, and class-validated creation of public car/setup markers
 - clock-skew-safe personal timer start/window normalization
 - bounded current-session lap, best-lap, and average calculations
 
@@ -621,7 +622,7 @@ Mutations:
 Route behavior:
 - `/?view=training` opens the training view directly
 - `driver=<profileId>` selects a personal profile and `class=<classId>` selects its performance class for bookmarks
-- an explicitly enabled personal profile receives `/public-training/<shareToken>` as a separate read-only profile with a class selector
+- an explicitly enabled personal profile receives `/public-training/<shareToken>` as a separate restricted profile with a class selector and one token-limited setup-marker action
 - replacing or disabling the share invalidates its old route immediately after state sync
 
 ### `public-training.html`
@@ -639,7 +640,8 @@ Type:
 - standalone public profile frontend
 
 Owns:
-- fetching only `/public-training/api/:shareToken`
+- fetching profile data from `GET /public-training/api/:shareToken`
+- posting only class-scoped setup markers to `POST /public-training/api/:shareToken/markers`
 - rendering one person's sanitized statistics, pace chart, recent stints, goals, rewards, and daily history with a class selector
 - hiding optional sections according to the server-provided share visibility map
 - switching between class-specific statistics without combining lap performance across classes
@@ -650,7 +652,7 @@ Owns:
 Important isolation:
 - does not import `app.js`
 - does not call `/api/state`
-- does not mutate backend or race state
+- cannot mutate race, register, timing, goal, or reward state; its only backend mutation is an authenticated class-scoped setup marker
 - timer state is stored in the mobile browser under a token-and-class-scoped localStorage key
 - session-window responses contain aggregates only; individual lap rows and timestamps are not exposed
 
@@ -2306,6 +2308,7 @@ Use for:
 Routes:
 - page: `GET /public-training/:shareToken`
 - data: `GET /public-training/api/:shareToken`
+- restricted marker action: `POST /public-training/api/:shareToken/markers`
 
 Authorization:
 - `shareToken` must match an enabled entry in `state.training.shares`
@@ -2318,6 +2321,7 @@ Sanitized response fields:
 - no club rank or other driver names; the public profile focuses on personal development
 - class-specific totals plus optional pace history, achievements, stint summaries, best-three, five-minute result, goals, and daily summaries
 - optional detail sections are omitted server-side according to the share visibility map; core lap/day/best/consistency totals remain visible
+- performance data includes bounded active 30-minute pace buckets and recent stint summaries without raw laps
 - optional class-specific `currentSession` aggregates when a valid start age (or backward-compatible recent `since` timestamp) is supplied
 - class-specific next automatic milestone, recommendation level, target lap, goals, and reward progress
 - public club branding and safe PNG/JPEG/WebP logo data