test: vitest unit + playwright e2e suites; fix a11y, contrast, no-JS reveal

- vitest: dictionary parity, slug-map bijection, content-schema validation, JSON-LD (23)
- playwright: both locales, language-switch mapping (incl. no-JS), CV downloads,
  form happy-path + honeypot, axe a11y on 5 templates x 2 themes (23)
- fix: raise ink-faint + light accent to meet WCAG AA 4.5:1 (axe-verified)
- fix: gate reveal animations behind html.js so content is visible without JS
  (progressive enhancement - was hidden at opacity 0); scan reduced-motion path
- fix: validate contact form before the anti-bot time-trap (no false success)
- chore: ESLint node globals, typed diagram props, resvg fontFiles, prettier pass

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

site/src/scripts/form.ts

@@ -66,6 +66,10 @@ if (form) {
       company: String(fd.get('company') ?? ''), // honeypot
     };
 
+    // Validate first, so a real person who submits an incomplete form always sees
+    // the field errors (never a false "success").
+    if (!validate(data)) return;
+
     // Honeypot filled or submitted implausibly fast → treat as bot, feign success.
     if (data.company || Date.now() - loadedAt < 2000) {
       form.hidden = true;
@@ -73,8 +77,6 @@ if (form) {
       return;
     }
 
-    if (!validate(data)) return;
-
     submitBtn?.setAttribute('disabled', 'true');
     if (submitLabel) submitLabel.textContent = sendingText;
     submitBtn?.classList.add('is-sending');