A pure SVG card renderer: src/web/og/card.ts turns {kind, title, lines, stat} into a 1200×630 card in the studio's tokens #1470

Split from #1054 (parked twice: both pulls went red on the gate's list check, not on their own work. Main was missing four files in scripts/gate.ts then; 0.7.75 is green).

Intent. One pure module, zero dependencies, that the OG route and the OG designs (#454, #455) fill in.

Done looks like.

• [ ] src/web/og/card.ts exports a pure function from {kind, title, lines, stat} to an SVG string, 1200×630, using colour and type tokens from src/design.
• [ ] Every text is XML-escaped and clamped to the card's width with an ellipsis. Nothing overflows.
• [ ] test/og-card.test.ts: each kind renders well-formed XML at 1200×630, and a hostile title (<script>, &, 500 chars) comes out escaped and clamped.
• [ ] test/og-card.test.ts is named in GATE in scripts/gate.ts. Before the pull: bun test test/og-card.test.ts test/check-list.test.ts and bunx tsc --noEmit pass in the sandbox, and the pull says so.
• [ ] Does not touch forge.json and adds no route.

Files. src/web/og/card.ts (new), test/og-card.test.ts (new), scripts/gate.ts. Fits: scout.