fix(design): an audit of the S3d claims — the float shadow, filter hints, one action size per row (E28 S3d)

- A glass role's shadow is one token (shadow-float); the header search's drop-shadow utility had
  replaced its top highlight, and the debug pill's shadow-lg did the same. The surface-role lint
  rule now refuses a shadow size beside a role.
- Plex: every value that filters carries a hint (genre, certificate, studio had none), and the facts
  panel's year and certificate filter like the header's. filterKeyword -> filterValue.
- Downloads: the row resized its buttons with a [&_button] override that the save link escaped
  (28px beside 32px); the size is the primitive's md rung now.

frontend/src/lib/surfaceRole.contract.test.ts

@@ -42,3 +42,25 @@ describe("a bare glass tier", () => {
     ).toBe(0);
   });
 });
+
+// A role brings its own shadow, whose inset top highlight a `shadow-*` size would replace wholesale.
+describe("a shadow size beside a role", () => {
+  const SUR = 'import clsx from "clsx";\nimport { SURFACE } from "./ui/surfaces";\n';
+  const tpl = (cls: string) =>
+    `${SUR}export const A = () => <div className={\`\${SURFACE.floating} ${cls}\`} />;\n`;
+  const call = (role: string, cls: string) =>
+    `${SUR}export const B = () => <div className={clsx(SURFACE.${role}, "${cls}")} />;\n`;
+
+  it("is refused in a template and in clsx, variants included", async () => {
+    expect(await hits(tpl("h-12 shadow-lg"))).toBe(1);
+    expect(await hits(call("menu", "hover:shadow-2xl"))).toBe(1);
+  });
+
+  it("passes a shadow colour, shadow-float, and a shadow with no role beside it", async () => {
+    expect(await hits(tpl("shadow-black/20"))).toBe(0);
+    expect(await hits(call("popover", "shadow-float"))).toBe(0);
+    expect(await hits('export const E = () => <div className="rounded-lg shadow-lg" />;\n')).toBe(
+      0,
+    );
+  });
+});