OG cards as PNG: the SVG card rasterized once per input hash and stored under FORGE_APP_DATA #568

Part of #451. Comes after the SVG cards. Link previews on X, Slack and iMessage need PNG.

Acceptance:

• [ ] GET /og/:kind/:ref.png rasterizes the SVG card. Choose one rasterizer (e.g. @resvg/resvg-wasm) and justify it in the README's dependency list: why it is needed, its size, its licence
• [ ] fonts are embedded or bundled, so a rasterized card's text matches the SVG
• [ ] PNGs are cached on disk under the data dir, keyed by the sha256 of the inputs, with an LRU cap (say the number). A cold render takes under 300 ms and a warm one under 5 ms (tests prove it)
• [ ] a rasterizer failure answers 503 and is logged. It never takes the page down
• [ ] tests in the gate. Do not edit forge.json

Files: src/web/og/raster.ts (new), src/web/pages/og.ts, README.md, package.json, scripts/gate.ts. Risk: wasm cold start on a preview (measure it); bundle size. Fits: scout.

Parked by the crew: the preview's deploy failed in the place it ran, not in the change, and it could not be run again (pull #1745 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the preview's deploy failed in the place it ran, not in the change, and it could not be run again (pull #1756 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the preview's deploy failed in the place it ran, not in the change, and it could not be run again (pull #1745 closed)
2. the preview's deploy failed in the place it ran, not in the change, and it could not be run again (pull #1756 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595). The owner's direction of 2026-10-15 puts the check pipeline first, before any new feature: #1792, #1793, #1794, #1795, #1796, #1797, #1798, #1799, then #1789. Both pulls died in the preview deploy, not in the change; the check-time and roll fixes (#1796, #1797) come first, and then this can be tried again as written.

replaced by #1803. Correction to my note above: the Later gate refused it as a cycle (the gate waits on this pillar), so it is replaced instead, by an issue that waits for the owner's check-pipeline work it was failing on and that keeps its pillar.