feat(v3.17.0): WCAG AA contrast verification + sw.js cache auto-bump

[vnykmshr]

Summary

WCAG AA sweep across 5 color presets × 2 modes found 4 link-color contexts failing 4.5:1; all lifted to passing (ocean light 3.68→5.36, forest light 3.77→5.48, sunset light 3.56→5.18, default dark 3.45→7.02). Service worker CACHE_VERSION is now auto-injected at server startup from build version — operators no longer track manual bumps. Plus hygiene: prependCard innerHTML → createElement, vestigial articles.css delete, msapplication-navbutton-color drop.

Closes #85, #86, #90, #91, #93. Triage cycle also closed #88, #89, #92, #94, #95 as wontfix (calm-design conflict / no signal / fragile mechanism).

Changes

• C1 feat(serve): inject sw.js CACHE_VERSION at startup from build version — embedded __MARKGO_CACHE_VERSION__ placeholder substituted once at startup; STATIC_PATH overlay serves raw bytes (operator owns their cache version); fail-loud on missing placeholder; 3 unit + 3 integration tests in sw_test.go
• C2 feat(a11y): lift --color-primary to AA 4.5:1 across 4 outlier contexts — preset bumps in main.css + minimal.css dark-block --theme-primary lift. Cascade was inert because --theme-primary was set on :root unconditionally, defeating the var(--theme-primary, #60a5fa) fallback chain
• C3 refactor(web): replace prependCard innerHTML with createElement chains — already escape-safe; hygiene swap for grep-ability; escapeHTML helper deleted with last callers
• C4 chore(web): delete vestigial articles.css and msapplication-navbutton-color — audit-doc claim of stale vnykmshr.github.io URLs verified false (zero hits across repo); audit-finding: <meta> proliferation audit in base.html (62 tags) #93 narrows to 1-line legacy-meta drop
• C5 docs(changelog): v3.17.0 release notes

Test plan

• make lint && make test-race green
• make coverage 63.7% (CI threshold 45%)
• Playwright contrast re-audit: all 10 contexts ≥4.5:1
• curl /sw.js (no STATIC_PATH) → embedded body with CACHE_VERSION = 'dev' substituted; placeholder count = 0
• curl /sw.js (with STATIC_PATH overlay) → raw operator bytes verbatim, no substitution
• curl / → 0 references to articles.css or msapplication-navbutton-color
• Playwright prependCard simulation: both branches render hostile content as textContent (no script/img injection)
• Post-merge: SW cache names show markgo-precache-v3.17.0 in DevTools after deploy

[vnykmshr]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}