chore: archive one-off patch scripts instead of leaving them at repo root

fix_lang_search.py, fix_stats_lock.py, and fix_conn_map_xss.py were
committed at the project root with no indication of whether they'd
already been applied or were still pending. fix_lang_search.py in
particular is the literal source of the app.js SyntaxError fixed
earlier in this branch -- worth keeping as a record, but clearly
marked as already-applied and not safe to re-run.

Moved all three into scripts/patches/ with an .applied suffix and a
README explaining the convention going forward.

scripts/patches/README.md

@@ -0,0 +1,12 @@
+# Applied patch scripts (archive)
+
+These were one-off scripts used to patch specific bugs during earlier
+sprints. They have already been run against the codebase and are kept
+here (renamed `.applied`) purely as a record of what was changed and
+why -- do NOT re-run them, they are not idempotent and some (see
+fix_lang_search.py.applied) contain the literal source of a bug that
+was fixed in a later commit.
+
+If you need to make a similar fix in the future, write a fresh patch
+script, test it with `node --check` / `python3 -m py_compile` before
+committing, and archive it here afterward the same way.