Add design tokens and self-hosted fonts

Copy the handoff tokens.css into web/src/styles/tokens.css verbatim except
the Google Fonts @import, replaced by @font-face rules for self-hosted
Bagel Fat One (400) and Figtree (400/600/700) woff2 files, committed with
their OFL licence texts. Base styles set the page background, text colour,
Figtree body and the accent focus outline.

npm test now runs lint:colors, which fails on any hex colour literal in
web/src outside tokens.css. npm run build ends with check:dist-fonts, which
fails if dist references fonts.googleapis.com or fonts.gstatic.com.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/package.json

@@ -5,10 +5,12 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "tsc --noEmit && vite build",
+    "build": "tsc --noEmit && vite build && npm run check:dist-fonts",
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "npm run lint:colors && vitest run",
+    "lint:colors": "node scripts/lint-colors.mjs",
+    "check:dist-fonts": "node scripts/check-dist-fonts.mjs"
   },
   "dependencies": {
     "@tanstack/react-query": "^5.104.1",