feat: public access via reverse proxy + 'The Ledger' UI design pass

- compose publishes 8787 on all interfaces (NPM fronts it at
  bountyboard.anypreta.com); APP_BASE_URL + TRUSTED_PROXY_CIDRS configured,
  client-IP resolution through the proxy verified live
- design: self-hosted variable fonts (Fraunces display serif, Schibsted
  Grotesk UI, Spline Sans Mono ledger numerals), paper-grain overlay,
  hairline double rules, letterpress buttons, stamped badges, banknote
  bounty chips, ledger tables, staggered page reveal (reduced-motion safe)
- §10 tokens, 2px radius, both themes, AA contrast preserved exactly;
  no build step, CSP-clean (fonts/img self/data)
- login/register masthead; headless-chrome screenshots verified both themes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/templates/login.html

@@ -1,4 +1,9 @@
 {{define "content"}}
+<header class="masthead">
+  <p class="masthead-kicker">Consulting Work Exchange</p>
+  <p class="masthead-title">◈ Bounty Board</p>
+  <p class="masthead-rule">❦</p>
+</header>
 <div class="card">
   <h1>Log in</h1>
   <div class="error-box" id="error" role="alert">{{.Error}}</div>

web/templates/register.html

@@ -1,4 +1,9 @@
 {{define "content"}}
+<header class="masthead">
+  <p class="masthead-kicker">Consulting Work Exchange</p>
+  <p class="masthead-title">◈ Bounty Board</p>
+  <p class="masthead-rule">❦</p>
+</header>
 <div class="card">
   <h1>Create account</h1>
   <p class="hint">Self-registration creates a developer account. Consultant and admin roles are granted by an administrator.</p>