fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/lib/plexImage.contract.test.ts

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { expect, it } from "vitest";
 
 import { cardImage } from "./plexImage";
+import { readSources } from "./rawSources.testkit";
 
 // A card's srcset names each Plex cut by its width, and the browser picks one by that width. The
 // widths are the image proxy's (backend `app/plex/imgcache.py` SIZES), with no wire format between
@@ -51,14 +52,11 @@ it("names each backdrop cut by the width the proxy cuts it at", () => {
 // proxy's; the SET is pinned, so a new one fails here. Every <img>'s src counts, wherever it sits
 // among the attributes and whatever its variable is called: the first cut of this test read only a
 // leading `src={…thumb…}` and missed two of the three sites it was written for.
-const plexFiles = import.meta.glob(
-  [
-    "../components/{Plex,plex}*.tsx",
-    "../components/{Home,PosterTile,UpNextCard}.tsx",
-    "!../components/**/*.test.tsx",
-  ],
-  { query: "?raw", import: "default", eager: true },
-);
+const plexFiles = readSources(__dirname, [
+  "../components/{Plex,plex}*.tsx",
+  "../components/{Home,PosterTile,UpNextCard}.tsx",
+  "!../components/**/*.test.tsx",
+]);
 const ALLOWED = new Set([
   "plexCards.tsx pic.src", // cardImage's own src (srcSet/sizes beside it): the card cut
   "plexCards.tsx c.thumb", // cast photos: the person-image route, not the image proxy