OG cards as SVG: `/og/:kind/:ref.svg` composed from live data with the studio's tokens, cached by input hash #1054

Replaces #567, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1008 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1034 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #567's, unchanged:

---

Replaces #452, which was parked twice: the rasterizer dependency and a forge.json conflict sank it. This issue is the SVG half only, with zero new dependencies. PNG comes next.

Intent: one pure module turns typed page data into a 1200×630 SVG card that the OG designs (#454, #455) can fill in.

Acceptance:

• [ ] src/web/og/card.ts: a pure function from {kind, title, lines, stat} to an SVG string, using the studio's colour and type tokens from src/design. Text is XML-escaped and clamped to the card's width (ellipsis, no overflow)
• [ ] GET /og/:kind/:ref.svg for kinds app, repo, issue, pull and run, reading only what the viewer may read (a private repo returns 404). Unknown kinds return 404
• [ ] cached in memory by the sha256 of the inputs, with an ETag from that hash and Cache-Control: public, max-age=300. A second request answers 304 to If-None-Match
• [ ] tests (in the gate): each kind renders well-formed XML at 1200×630; a hostile title (<script>, &, 500 chars) is escaped and clamped; a warm request takes under 5 ms
• [ ] does not touch forge.json

Files: src/web/og/card.ts (new), src/web/pages/og.ts (new), src/http/server.ts, scripts/gate.ts, test/og-card.test.ts. Fits: scout.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1371 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1418 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1371 closed)
2. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1418 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1470 (the pure SVG renderer) and #1471 (the /og/:kind/:ref.svg route with its hash cache). Both tries went red on the gate's list check, which was main's own fault, not this change's: main had four test files listed nowhere, and 0.7.75 fixed that. Each half now names its test file in GATE and runs the list check in the sandbox before its pull. #454, #455 and #568 now wait for #1471.