feat(site): phase 1 — the foundation

Astro 7 with the Node adapter, Starlight mounted at /docs, the token file, both
self-hosted typefaces, the layout shell, and the two build-time checks from §12.

The palette's gold and cyan are sampled from runic-emblem.png rather than
guessed, per §11: 494,059 opaque pixels binned by hue, each value annotated with
its measured contrast against the ground, and restricted rather than brightened
where a ratio fails.

- checkTokens.mjs fails the build on any colour literal outside tokens.css,
  which is what keeps §7's "recolouring is a file copy" promise true.
- checkFacts.mjs re-reads all 14 externally-sourced facts from their authorities
  over the Gitea API and fails on disagreement. It also enforces D13: no email
  address in the source outside brand-default/brand.json.
- Both were negative-tested; neither has ever been allowed to pass by default.

§6 asks for output:'server' with per-page prerender=true. Astro 7 expresses the
same runtime shape as output:'static' with an adapter, opting individual routes
out — so the default is static rather than accidentally server-rendered.

Co-Authored-By: Claude <noreply@anthropic.com>

brand-default/brand.json

@@ -0,0 +1,32 @@
+{
+  "$comment": [
+    "PLAN.md §7: the stock brand, baked into the image at /app/brand-default and always",
+    "complete. The bind mount at /app/brand may be empty, partial or full; every field and",
+    "every asset resolves against the mount first and these defaults second, per key, so an",
+    "empty mount produces exactly this.",
+    "",
+    "This file is also the ONLY place in the repository allowed to contain an email address",
+    "(D13). The org lead has no mailbox at the domain and chose to publish the existing",
+    "address rather than delay the beta; what makes that reversible is that moving to",
+    "privacy@ / security@ later is an edit to the mounted copy of this file and a container",
+    "restart — no rebuild, no PR. scripts/checkFacts.mjs fails the build if an address",
+    "appears anywhere else in the source, because the promise only survives while that",
+    "stays true."
+  ],
+
+  "siteName": "Runic Gateway",
+  "tagline": "Put your game server on the web without putting it on the internet.",
+
+  "contactEmail": "whitlocktech@gmail.com",
+
+  "discordInvite": "https://discord.gg/t2Jav8yT4g",
+  "giteaOrg": "https://gitea.whitlocktech.com/RunicGateway",
+
+  "$comment_demo": [
+    "§15 / D12. A public demo instance is planned and out of scope today. The homepage's",
+    "'See it running' slot and /features/'s per-capability affordance render only when this",
+    "is a non-empty URL, so the site gains a working demo by way of one line in a mounted",
+    "file — no rebuild, consistent with §7."
+  ],
+  "demoUrl": ""
+}