Add a protocols.io users report, and fix three things on the figshare one

[robsv]

Adds /protocolsio_users under DataCite ▸ protocols.io, the counterpart to
/figshare_users. Also fixes three things on the figshare report, which is
already on main, because this branch touches the same code.

Authors 90 Protocol DOIs 57
Current Janelian 36
Contingent worker 8
No longer at Janelia 25
Unknown 21

It is not quite the same report, and that is forced

protocols.io publishes no user list at all. There is no institution roster,
no user search, and no members endpoint — a workspace exposes a member count
and nothing else. Their only account endpoint returns the caller's own profile.

So where figshare lists its 144 institutional accounts, the available
population here is whoever is credited on a protocol. Some of the unmatched are
genuinely collaborators from elsewhere rather than roster gaps, and the page
says so rather than leaving it to be inferred.

Built from our own records, not their API

Two reasons, and the second was a surprise:

• Fetching all 50 protocols for their affiliations takes 31.6 seconds
  (measured). That is not a page load. This renders instantly.
• protocols.io returns no ORCID anywhere in its API, while our Crossref
  copy carries one for 22 authors, 21 of which match the roster outright. Our
  own data is the stronger key.

protocols.io arrives via Crossref, so author keys are given/family rather
than the givenName/familyName a DataCite record uses.

A wrong fuzzy match, found and fixed

The matcher paired Liu Liu → Zhe J. Liu at 95. Different people —
WRatio rewards containment, and the surname appears in both.

Moved to token_sort_ratio, which scores that pair 47 while still reaching
a name written surname-first. The cutoff drops 92 → 85 because the genuine
matches are not close: a dropped middle initial scores 90, an extra given name
88. Verified against both reports — the bad pair is gone, all four real matches
survive.

Names differing by one letter in the surname still score about 91, so every
fuzzy match is labelled with its score for a reader to judge.

Duplicate people are now marked

An orange badge beside the name, tooltip naming the other appearances.

Grouped on the roster record, not the displayed name — which is what
catches the interesting case. One person is credited on protocols.io as
Virginie M S Ruetten, Virginia M S Ruetten, Virginia Ruetten and
Virginie Ruetten, all the same ORCID, and no two of those strings are equal.
A row matching nobody falls back to its own name, so two accounts under one
spelling still pair up.

On figshare this finds two people with two accounts each (Vivek Jayaraman,
Johan Winnubst — one of whose second address is external).

Dark text on the orange, not white: white on #f97316 is 3.6:1, too thin at
this size; #1a1a1a is 6.2:1.

Also fixed on /figshare_users

• Double-escaped names. Courtney "CJ" Johnson rendered as
  Courtney "CJ" Johnson. render_table escapes any cell not
  wrapped in safe(), so passing escape(name) escaped it twice. Fixed in
  three places — the third, in the acknowledgement metrics table, has the same
  bug and has simply never held a name with a character worth escaping.
  Escaping still happens; it just happens once.
• Sort order. The two pages disagreed on landing order. Both now sort by
  status, then name. Protocol count remains a sortable column.
• FIGSHARE_USER_KINDS / FIGSHARE_NAME_CUTOFF become ROSTER_*, since
  neither belongs to figshare now.

Testing

113 tests pass, no new lint messages. Both pages verified against a running
server — bucket counts, badge rendering, tooltip contents, landing order, and
the absence of double-escape markers.

🤖 Generated with Claude Code

@stuarteberg