fix(web): review round 1: optimistic edits, friendly errors, preferences, Gelasio

- Tags and custom fields update the cached entry optimistically and build
  from the latest cache; one entry's PATCHes run in order (mutation scope).
- The review textarea follows server changes (Restore) unless edited.
- friendlyError() maps validation reasons and 413 to plain copy everywhere.
- Rating scale from me/preferences; /login and /register use auth/status;
  Attachments lists from the API.
- Gelasio vendored (official OFL variable TTFs); minors from the review.
- Docs: DESIGN (AA on orange, faint labels), DECISIONS, TODO, ARCHITECTURE.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/main.tsx

@@ -3,6 +3,7 @@ import { StrictMode, type ReactNode } from "react";
 import { createRoot } from "react-dom/client";
 import { Redirect, Route, Switch } from "wouter";
 import { ApiError } from "./api.ts";
+import { friendlyError } from "./format.ts";
 import { Shell } from "./components/Shell.tsx";
 import { useMe } from "./hooks.ts";
 import { Library } from "./routes/library.tsx";
@@ -35,7 +36,7 @@ function RequireAuth({ children }: { children: ReactNode }) {
         <div className="auth-card" role="alert">
           <span className="logo">STTracker</span>
           <h1>Can't load your library</h1>
-          <p className="lede">{me.error.message}</p>
+          <p className="lede">{friendlyError(me.error)}</p>
           <button className="btn primary" onClick={() => void me.refetch()}>Try again</button>
         </div>
       </div>