fix(design): rating and live colour tokens, the player's menus over its notices, the info overlay on a light theme (E28)

- F16: --rating (theme-scoped gold, 4.5:1 on the page and its chip), --rating-media, --live/--live-fg,
  --media-chrome replace 14 palette literals; a lint rule refuses palette classes; the theme contract
  measures them.
- The Plex player's notices drew over its open settings/tracks popovers: notices z-base, popovers z-menu.
- The player's info overlay rendered theme tokens on its always-dark panel: on a light theme the score
  (2.6:1), collection years (3.2:1) and cast initials (1.05:1) were unreadable; onDark variants now.
- The lint-rule contract tests share one ESLint with a one-off warm-up (a cold first lint took 8 s,
  past vitest's 5 s).

frontend/src/lib/jsxCommentText.contract.test.ts

@@ -1,16 +1,13 @@
-import { fileURLToPath } from "node:url";
-
-import { ESLint } from "eslint";
 import { describe, expect, it } from "vitest";
 
+import { eslint } from "./lintProbe.testkit";
+
 // `local/jsx-comment-text` (eslint.config.js): a `//` inside JSX children is rendered as text. One
 // reached the Playlists page past tsc, eslint and every test — only a visual check caught it. A rule
 // that matches nothing looks exactly like a clean codebase, so this asserts it fires.
 const RULE = "local/jsx-comment-text";
-const FRONTEND = fileURLToPath(new URL("../../", import.meta.url));
 
 async function hits(source: string): Promise<number> {
-  const eslint = new ESLint({ cwd: FRONTEND });
   const [result] = await eslint.lintText(source, { filePath: "src/components/__probe.tsx" });
   return (result?.messages ?? []).filter((m) => m.ruleId === RULE).length;
 }