review-web-app: add shadcn token audits (coverage + theme integrity)

[efordee24]

Summary

• A kuat-mono consumer test proved shadcn init/add can silently override Kuat's semantic tokens (an unlayered shadcn :root beats kuat-core's layered tokens regardless of import order) even when the added component renders fine — coverage review alone (token names) misses this because it never checks resolved values.
• Adds a Token audits step to review-web-app for any shadcn/third-party UI item in scope, run against the shipped @equal-experts/kuat-core/token-contract.json:
  1. Coverage (names) — enumerate consumed tokens/utilities, diff against the contract's authored vocabulary. Reports ✅ inherited / ⚠️ missing / ⚠️ dark-gap, plus a WCAG contrast note.
  2. Theme integrity (values) — resolve the app's effective :root/.dark and diff each semantic token's resolved colour against the contract. Reports ✅ intact / ⚠️ OVERRIDDEN — this is what catches the clobber coverage alone misses.
• Fixed resolution rule: gaps/overrides get added to kuat-core (light + dark), never left resolving to a shadcn default. Gaps write a structured feedback record to .kuat/feedback/.
• No audit script is published yet (lives unpublished in kuat-mono), so this is deliberately a manual enumerate → diff → resolve activity for now, same as every other cited rule in this skill — publishing kuat-core audit bins is called out as an open packaging decision, not assumed here.
• Rebuilt plugins/kuat-build via node skills/scripts/build-plugin.mjs so the packaged copy of review-web-app picks up the change (diff-checked — only the intended content + routine ref/date stamps landed).

Context for reviewers

• This is one half of a two-repo fix from a kuat-mono handoff report (docs/shadcn/agent-rules-skill-fixes.md). The other half — fixing the kuat-react skill's first-time-setup so it doesn't clobber Kuat's theme when shadcn is added — lives in kuat-claude-plugin (separate repo, no PR here) and has already been applied there.
• plugins/kuat-studio shows no skill diff since it doesn't bundle review-web-app; its manifest/changelog only picked up the routine rebuild ref/date stamp (repo HEAD advanced earlier in this session via git pull).

Test plan

• Read through the new "Token audits" subsection for internal consistency (references the contract, checklist item, resolution rule, feedback record all line up)
• Ran node skills/scripts/build-plugin.mjs and diffed the generated plugins/kuat-build/skills/review-web-app/SKILL.md — confirmed only the new content (path-rewritten) landed, no drift
• Follow-up (not blocking): add an eval case exercising a shadcn item with a deliberately overridden token, per docs/migration/evals/review-web-app.md's existing pattern

🤖 Generated with Claude Code