Latency statistics written once, thresholds read from CONFIG (closes #102)

A target's min, max, median and average latency now come from one list
of its answers, through latencyStats(), which the summary's figures use
too, so the median is written once. latencyHex() and latencyClass() read
one table of color limits in CONFIG. The health thresholds, the debug
log's length, the gateway check's timeout, the recovery probe's number
of hosts and interval, how often the rows are sorted and the delay
before the first sparkline resize are CONFIG entries, read where the
numbers were. minLatency() and its three siblings stay for the unit
tests. Nothing the page does or shows changes. A unit test now covers
the summary's figures.

Model: opus-5-5

TODO.md

@@ -23,6 +23,16 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-04: in `src/main.js` (issue #102), a target's min, max, median and
+  average latency come from one list of its answers, through the same function
+  the summary's figures use, so the median is written once. The latency color
+  limits are one table in `CONFIG`, read by both the figure's and the
+  sparkline's color. The health thresholds, the debug log's length, the gateway
+  check's timeout, the recovery probe's number of hosts and interval, how often
+  the rows are sorted and the delay before the first sparkline resize are
+  `CONFIG` entries too. A unit test checks the summary's figures. Nothing the
+  page does or shows changed; the footer's color legend still writes the limits
+  out as text
 - 2026-10-04: a target's name and URL and a debug log message show as the
   characters they are and are never read as HTML (issue #29): a host row escapes
   the name and URL it writes into its markup, and the debug log sets each line