refactor(ui): consume the shared web-platform package

[zoeyrose]

Summary

Adopt the versioned Atrinik shared web-platform package once its ownership, release, provenance, and contract are established in atrinik/atrinik#510.

The website remains the sole owner of atrinik.org, its static Astro source, content, metadata, security headers, Pages configuration, preview policy, and production deployment.

Scope

• Replace duplicated shared brand tokens, favicon/mask-icon assets, and suitable low-level presentation primitives with pinned package dependencies.
• Consume only build-time package exports; do not add remote CSS, runtime package fetching, or repository submodules.
• Keep site-specific page layouts, navigation/content decisions, canonical origins, robots policy, structured metadata, CSP, headers, redirects, media/download provenance, and accessibility/performance budgets in this repository.
• Permit explicit site variants where Observatory or future Atrinik properties need a different product identity; avoid accidental visual drift.
• Update deployment and provenance documentation when package assets or build inputs change.

Acceptance criteria

• The shared package is version-pinned in the website lockfile and can be updated through a reviewed dependency PR.
• npm run check, npm run build, npm run deploy:dry-run, and the existing static-output/security/privacy validation remain green.
• The built site remains static and repository-authored browser JavaScript remains prohibited unless a separate approved issue changes that contract.
• Favicon, mask-icon, and other reused assets retain complete attribution, license, source, digest, and transformation evidence.
• Website previews and production deployment remain independently deployable, promotable, and rollbackable; a package release alone does not deploy atrinik.org.
• The final implementation links the producer package and consumer issues and records any intentional website-specific exceptions.

Non-goals

• Do not move website content or deployment ownership into the shared package repository.
• Do not make the website depend on Observatory, metaserver D1/R2 state, or a live metaserver refresh for ordinary static pages.
• Do not introduce a website/application monorepo as part of this consumer migration.