Feature: bring proxy-hint detection (chi-squared) to the web profiler #738

Where: assets/profiler-engine.js, profiler.html (dropzone hint text), faircode/proxy.py, faircode/SPEC.md section 3.

Current gap: faircode profile/compare --proxy-hints (CLI-only) flags column pairs strongly associated via chi-squared + Cramér's V - "this column may be a proxy for that protected attribute." SPEC.md explicitly says this is "intentionally NOT part of the JS engine" because it's opt-in/informational and never affects the score, and profiler.html's own dropzone hint tells web users to go use the CLI for it: "Proxy-hint detection: use faircode profile/compare --proxy-hints from the CLI." A web-only user with no Python/CLI access currently cannot get proxy-hint analysis at all, even though the JS engine already computes crosstabs for intersections.

Repro:

$ grep -n "Proxy-hint detection" profiler.html
178-179: Proxy-hint detection: use faircode profile/compare --proxy-hints from the CLI.
$ grep -n "intentionally NOT part of the JS engine" faircode/SPEC.md
(matches, section 3)

Suggested approach: port the chi-squared test to JS as a separate, explicitly-informational module (mirroring the "opt-in, never touches score, not parity-tested" contract already established for the Python side) - a JS chi-square CDF only needs a regularized incomplete gamma function, a well-known ~20-line implementation. Surface it in the web UI as an opt-in "Check for proxy columns" button/toggle inside the results section, reusing the existing labelize-by-kind logic already in profiler-engine.js. Since SPEC.md's parity contract only covers profile()/compare(), adding this as a separate, clearly-labeled module keeps the bit-for-bit parity test unaffected.