Apply the theme: tokens, Oswald, song cards, toasts

The theme handoff encoded as CSS custom properties rather than a Tailwind
config, since there is no Tailwind here. Palette, spacing, radii, shadows and
motion follow it as written; docs/theme.md lists what differs and why.

- Oswald vendored as a 21KB variable woff2, latin subset, no CDN. Its phantom
  weight 900 resolved to 700 — loading a weight you don't have is what made
  the brand render differently per platform
- color-scheme: dark makes the native audio element fit the palette, which
  was the handoff's complaint about it
- Songs are text cards rather than artwork tiles, because there is no
  artwork. The unreviewed state keeps its red-brown border and gains a badge,
  so it is never carried by colour alone
- Nav is the three-column grid; the mobile menu is <details>, no JS
- Flash messages became bottom-right toasts

Favicon carried over from the Nuxt project.

docs/decisions.md

@@ -162,6 +162,13 @@ says so.
 40. **`main` is release code, `dev` is development.** Work lands on `dev` and reaches `main` by merge
     at release, so `main` is always a list of things that shipped. Nightly builds, if any, come off
     `dev`.
+42. **The theme handoff is implemented as CSS custom properties, not a Tailwind config.** Its
+    palette, spacing, shadows, motion and component shapes are followed as written; the parts that
+    assumed Tailwind, Pico or cover artwork are adapted rather than dropped, and each adaptation is
+    listed in [theme.md](./theme.md). Oswald's phantom weight 900 resolved to 700 — loading a weight
+    you do not have is what made the brand render differently per platform. The custom audio player
+    stays deferred: `color-scheme: dark` makes the native control fit the palette, which was the
+    actual complaint.
 41. **No password minimum; rate limit logins instead.** A length policy protects against guessing,
     and guessing is better answered directly: 10 failures per email in 15 minutes, then a 15-minute
     lockout, cleared by a correct password. The floor was rejected because typing an 8-character