DEN-3970: add account journeys and harden marketing delivery

[ORESoftware]

Summary

• Add a responsive, accessible individual/organization account page and homepage cards, with persistent journey discovery and no-JavaScript navigation.
• Preserve customer authentication, product-owned membership, and separate platform-admin authority. Pin the two canonical PKCE return paths to the merged Rust onboarding contract.
• Keep hosted journey controls pending deployment. Public customer routes currently return 404/503 despite the new Rust image being published; source readiness is not hosted readiness. The promotion runbook requires exact Shared Auth return-path registration and synthetic end-to-end evidence.
• Harden the marketing session-hint state machine: unknown, anonymous, authenticated and unavailable are distinct. Require HTTP 200, valid bounded UTF-8 JSON, a 10-second deadline, no redirects, fixed destinations and deduplicated checks. Outages never claim logout.
• Upgrade Astro 5.18.2 to pinned 7.3.1, preserve HTML-aware spacing, pin Node 24.19.0 and checking tools, and move Pages publication to a locked, audited and tested build with immutable action pins and narrowly scoped write permissions.

Verification

• Locked install and full dependency audit: six reported affected packages before upgrade, zero after.
• Astro diagnostics: zero errors, warnings or hints; strict TypeScript check of the exhaustive state map.
• All four unit-test groups pass, including every state, malformed field types, retry bounds and untrusted destinations.
• Production build and every guide/account route, fragment, canonical URL and sitemap contract pass.
• Real Chromium fetch/body tests: 14 failure classes with recovery from both anonymous and authenticated states, including real timeout and concurrent-check deduplication.
• Desktop, narrow mobile, keyboard anchor and JavaScript-disabled checks pass. Both pending and enabled journey renderings tested locally; the committed promotion switch is false.
• All three modified workflows pass actionlint.

Tracking and remaining work

Related: DEN-3970, DEN-1147, platform umbrella.

DEN-1147 was amended to use the current split-host contract instead of its historical zpkg.tech acceptance text. This PR does not close the broad platform objective or claim hosted sign-in is operational. The existing rescue/lint PRs remain preserved; no history was rewritten or discarded.

[linear-code]

DEN-3970