fix(design): rating and live colour tokens, the player's menus over its notices, the info overlay on a light theme (E28)

- F16: --rating (theme-scoped gold, 4.5:1 on the page and its chip), --rating-media, --live/--live-fg,
  --media-chrome replace 14 palette literals; a lint rule refuses palette classes; the theme contract
  measures them.
- The Plex player's notices drew over its open settings/tracks popovers: notices z-base, popovers z-menu.
- The player's info overlay rendered theme tokens on its always-dark panel: on a light theme the score
  (2.6:1), collection years (3.2:1) and cast initials (1.05:1) were unreadable; onDark variants now.
- The lint-rule contract tests share one ESLint with a one-off warm-up (a cold first lint took 8 s,
  past vitest's 5 s).

frontend/src/lib/networkBoundary.contract.test.ts

@@ -1,17 +1,14 @@
-import { fileURLToPath } from "node:url";
-
-import { ESLint } from "eslint";
 import { describe, expect, it } from "vitest";
 
+import { eslint } from "./lintProbe.testkit";
+
 // E22 S4 put "every request is logged" into eslint.config.js, not prose: `fetch`, `XMLHttpRequest`
 // and `WebSocket` each belong to ONE module that logs them, and `console` to none. A restriction
 // that matches nothing looks exactly like a clean codebase, so this asserts the rules FIRE — and
 // that each owner is exempt from its own global only.
-const FRONTEND = fileURLToPath(new URL("../../", import.meta.url));
 const RULES = new Set(["no-restricted-globals", "no-restricted-properties", "no-console"]);
 
 async function flagged(source: string, filePath: string): Promise<string[]> {
-  const eslint = new ESLint({ cwd: FRONTEND });
   const [result] = await eslint.lintText(source, { filePath });
   return (result?.messages ?? [])
     .filter((m) => m.ruleId && RULES.has(m.ruleId))