feat(site): phase 1 — the foundation

Astro 7 with the Node adapter, Starlight mounted at /docs, the token file, both
self-hosted typefaces, the layout shell, and the two build-time checks from §12.

The palette's gold and cyan are sampled from runic-emblem.png rather than
guessed, per §11: 494,059 opaque pixels binned by hue, each value annotated with
its measured contrast against the ground, and restricted rather than brightened
where a ratio fails.

- checkTokens.mjs fails the build on any colour literal outside tokens.css,
  which is what keeps §7's "recolouring is a file copy" promise true.
- checkFacts.mjs re-reads all 14 externally-sourced facts from their authorities
  over the Gitea API and fails on disagreement. It also enforces D13: no email
  address in the source outside brand-default/brand.json.
- Both were negative-tested; neither has ever been allowed to pass by default.

§6 asks for output:'server' with per-page prerender=true. Astro 7 expresses the
same runtime shape as output:'static' with an adapter, opting individual routes
out — so the default is static rather than accidentally server-rendered.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/pr-checks.yml

@@ -0,0 +1,54 @@
+name: PR checks
+
+# Gitea Actions caution, learned elsewhere in this org: never leave an empty
+# template expression anywhere in a `run:` script, not even inside a comment.
+# The runner silently SKIPS the whole step without failing the job, and the
+# problem is invisible in the workflow list.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Design tokens
+        # PLAN.md §7 — no colour literal outside src/styles/tokens.css.
+        run: npm run check:tokens
+
+      - name: Types
+        run: npm run check
+
+      - name: Production build
+        run: npm run build
+
+      - name: Platform facts
+        # PLAN.md §12 — every version, protocol number and bundle tag is re-read from
+        # its authority over the Gitea API and must agree with src/data/platform.json.
+        #
+        # This needs a token that can read the OTHER repositories in the org: link,
+        # servuo-plugins, website and installer. The automatic per-run token is scoped
+        # to this repository alone and will 404 on all four, so the job reads an
+        # org-level secret instead.
+        #
+        # It runs last, and it is the only step that touches the network, so a Gitea
+        # outage cannot mask a real failure in the build.
+        env:
+          GITEA_TOKEN: ${{ secrets.PLATFORM_READ_TOKEN }}
+        run: npm run check:facts