fix(design): keep below/attention off the brand hue, harden the share-card fonts

Review follow-up on #86.

The blind coral -> brand rename recreated the exact collision this PR set out
to remove: coral had been both the primary CTA and the "below average" signal,
so every negative indicator followed --primary onto iris. Sixteen rules moved
back onto the status ramp — delta chips, trend-down arrows, progress-negative
values, statusBad, chipBad/badgeBad, and the urgent deadline chips.

The Ofsted scale had also lost its worst step, with grade 4 landing on brand
while 1-2 were teal and 3 was amber. It now escalates by weight rather than by
reaching for another hue: a tinted amber chip for "requires improvement", a
solid amber one for "inadequate" (5.1:1 light, 7.7:1 dark). Report-card grade 5
follows the same rule.

globals.css now describes status as valence — teal above/good, amber
below/needs-attention — which is what it has to mean for an urgent deadline,
rather than the narrower "comparison point only" the first draft claimed.

On the share-card fonts: /opengraph-image is prerendered, so the font read
happens in the builder stage where assets/ exists, and the baked PNG ships
inside .next/standalone/.next/server/app/. File tracing independently places
the fonts at .next/standalone/assets, which the existing standalone COPY
carries to /app/assets. So the reported ENOENT doesn't occur — but it depends
on the tracer resolving a runtime join(), and a miss would be a silent 500
rather than a build failure. Declared outputFileTracingIncludes for the route
and made the Dockerfile COPY explicit so neither is left to inference.

Also repointed the immutable Cache-Control rule from the deleted favicon.svg
to app/icon.svg, where it was caching a 404.

Verified: tsc clean, 159/159 tests, clean rebuild prerenders all three image
routes with the fonts present in standalone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nextjs-app/next.config.js

@@ -3,6 +3,15 @@ const nextConfig = {
   // Enable standalone output for Docker
   output: 'standalone',
 
+  // app/opengraph-image.tsx reads the Schibsted Grotesk files off disk at
+  // request time (Satori needs a font buffer; it has no system fallback).
+  // File tracing currently picks these up on its own, but that relies on the
+  // tracer resolving a runtime join() — declare them so a Next upgrade can't
+  // silently drop them and turn every link preview into a 500.
+  outputFileTracingIncludes: {
+    '/opengraph-image': ['./assets/**'],
+  },
+
   // The /api/* and /sitemap.xml proxies to the FastAPI backend are route
   // handlers (app/api/[...path]/route.ts, app/sitemap.xml/route.ts) rather
   // than rewrites, so the backend host is read from FASTAPI_URL at runtime
@@ -72,7 +81,9 @@ const nextConfig = {
         ],
       },
       {
-        source: '/favicon.svg',
+        // favicon.svg was replaced by app/icon.svg (the mark now has one
+        // source in components/Logo.tsx); this rule was caching a 404.
+        source: '/icon.svg',
         headers: [
           {
             key: 'Cache-Control',