fix(design): an audit of the S3d claims — the float shadow, filter hints, one action size per row (E28 S3d)

- A glass role's shadow is one token (shadow-float); the header search's drop-shadow utility had
  replaced its top highlight, and the debug pill's shadow-lg did the same. The surface-role lint
  rule now refuses a shadow size beside a role.
- Plex: every value that filters carries a hint (genre, certificate, studio had none), and the facts
  panel's year and certificate filter like the header's. filterKeyword -> filterValue.
- Downloads: the row resized its buttons with a [&_button] override that the save link escaped
  (28px beside 32px); the size is the primitive's md rung now.

docs/DESIGN.md

@@ -174,7 +174,8 @@ Also in force:
   violation. A call site names the ROLE (`SURFACE.panel` / `drawer` / `card` / `menu` / `popover` / `tooltip`,
   `ui/surfaces.ts`), which brings the tier AND the radius; a page section is a panel, and what floats over
   undimmed content (a menu, a hover card, a status popover, a toast, a tooltip) is `.glass-menu`. A bare glass
-  class is a lint error.
+  class is a lint error. A role's depth is its own shadow (the top highlight + the drop); a `shadow-*` size beside
+  a role would replace both and is a lint error too — a field that floats takes `shadow-float`, the same shadow.
 - **Static vs pressable (owner, S3d):** a label that does nothing (a topic, a keyword, a status, a count) is a
   flat, tonal `Badge` with no edge; everything that does something has an edge (a chip, a trigger, a field).
   A genre that filters the library is a chip; the same genre where it can't is a badge.