feat(cli): aura.css becomes the style pin — tokens, component library, CLAUDE.md rule

Second half of the style pin. assets/aura.css now carries (a) the full
:root token palette (Catppuccin-Mocha-derived; --bg deliberately darker
than Mocha base; new --border3 #585b70 completes the border ladder at an
identical computed value), (b) the shell rules migrated color-literal to
var() with identical computed values (font stacks stay literal — the
--mono token's longer fallback chain would change the computed value),
and (c) an opt-in, class-scoped component library distilled from the
milestone demo page (.aura-doc register, .wrap, .badge, .stats, .cards,
.term, .callout, table.res, .pipe) — unused by the runtime pages, which
render pixel-identically. CHART_CSS migrates to the same tokens (it
lands in the same document after the shell <style>, so :root resolves).
CLAUDE.md gains the binding '## HTML surfaces' rule: every HTML surface
embeds this asset; extend, never fork.

Gates: suite 1043/0, clippy -D warnings clean, doc build 0 warnings;
regenerated chart page resolves all 17 used var() names against its
:root. Independent CSS audit passed (two cosmetic notes: --bg3/--orange
currently unused; the pre-existing html,body height:100% also reaches
future .aura-doc pages).

closes #209

CLAUDE.md

@@ -161,6 +161,14 @@ design decision, not a refactor, and belongs in the ledger.
     streams during, recorded traces after) — never a scene editor; topology is
     grown in Rust + hot-reload, runtime params are UI-tunable.
 
+## HTML surfaces
+
+Every HTML surface — runtime-rendered (chart/graph viewer) or ad-hoc generated
+(demo/report pages) — embeds `crates/aura-cli/assets/aura.css` as its style
+source; the palette tokens and shared components live only there. New components
+extend that file; never fork the palette. Pages stay self-contained: all assets
+inlined, no external requests. Design record: issue #209.
+
 ## Skills plugin: project facts
 
 The few facts the skills plugin needs that genuinely vary per project.