Var-ify inline styles and snap off-scale type/radii (design Phase 2)

Phase 2 of the design-contract cleanup:
- 346 inline-style hexes (+7 #475569, mapped by property) -> var(--token),
  scoped to CSS-value position so JS-logic/quoted hex, the meta theme-color,
  SVG attrs, and the no-:root share-export region stay literal; #fff and
  no-token hexes left as-is.
- Snap off-scale font sizes (9/10.5->10, 11.5/12.5->12, 15->16, 24->22) and
  radii (3->4, 5->6, 7->6, 11->12, 9->8|10) to the scale.
- Bump to 0.2.161, which also ships the previously-uninstalled 0.2.160
  share-page HTML export.

ROADMAP.md

@@ -32,20 +32,26 @@ Verified: 144 tests pass, both pages serve 200, all 426+27 `var()` references re
 undefined vars. (`SHARE_PAGE_CSS` and `auth.html` are standalone documents that each carry
 their own copy — kept in sync; the meta `theme-color` stays a literal `#0a0e1a`.)
 
-**Phase 2 — REMAINING (deliberately deferred; these are *visible* changes, unlike Phase 1's
-no-op var migration).**
-- **Var-ify the long-tail inline `style=` attributes.** Phase 1 fixed the *drift* inline
-  values but left canonically-correct inline hexes as literals (the stylesheet is now the
-  single source of truth; inline styles still hardcode). Convert them to `var(--token)` now
-  that the tokens exist — but dodge the spots that can't take `var()`: the `<meta theme-color>`,
-  SVG `fill`/`stroke` set via JS (e.g. `index.html` sub-icon), and any hex used in JS *logic*
-  rather than as a CSS value. Per-occurrence judgement, not a blind sweep.
-- **Snap off-scale font sizes** to the scale: `15→16`, `24→22`, `9→10`, `12.5/11.5→12`,
-  `10.5→10` (~23 occurrences). Each is a small visible size change — eyeball per component.
-- **Snap off-scale radii**: `3→4`, `5→6`, `7→6|8`, `9→8|10`, `11→10|12` (~18; scrollbars,
-  history/queue action buttons, mobile submit/menu, buy inputs).
-- **(stretch) Generate `design/brand/palette.css` from the tokens** (Style Dictionary) and
-  `@import`/inline it, so the `:root` block isn't hand-maintained in three places.
+**Phase 2 — DONE 2026-06-17 (shipped in app 0.2.161).**
+- **Var-ified the long-tail inline `style=` attributes** — 346 inline-style hexes (+7
+  `#475569`, mapped by property to `--text-faint`/`--border-strong`) → `var(--token)`. Scoped
+  to CSS-value position (hex preceded by `:`/space/`,`, never a quote), which cleanly dodged
+  the non-`var()` spots: the `<meta theme-color>`, SVG `fill`/`stroke` attrs, and hex held in
+  JS *logic* (quoted ternary branches like `${cond ? "#1e293b" : ...}`, `const colour = …`).
+  Left as literals on purpose: `#fff` (its uses split between on-accent button text and
+  functional white — `--on-accent` doesn't cleanly cover both, zero visual gain), no-token
+  hexes (`#e0e7ff`/`#c7d2fe`/`#a78bfa`/`#04210f`/etc.), and the entire `SHARE_PAGE_*` export
+  region (a standalone doc with no `:root` — `var()` wouldn't resolve there).
+- **Snapped off-scale font sizes** (21 occ): `9/10.5→10`, `11.5/12.5→12`, `15→16`, `24→22`.
+  Left `40px`/`56px` display glyphs (success numeral, buy spinner) — off-scale by design.
+- **Snapped off-scale radii** (18 occ): `3→4`, `5→6`, `7→6`, `11→12`; `9→10` for the two 18px
+  capsules (`.menu-badge`, `.rc-spk` — radius clamps at 9 on an 18px box, so on-scale and
+  visually identical) and `9→8` for `.icon-btn`/`.buy-select-btn`/`.buy-discount-input`. Left
+  the `1px` hamburger-bar radius. Verified: 144 tests pass, both pages serve 200, every
+  introduced `var()` resolves against `:root`, no off-scale residue.
+- **(stretch, NOT done) Generate `design/brand/palette.css` from the tokens** (Style
+  Dictionary) and `@import`/inline it, so the `:root` block isn't hand-maintained in three
+  places. Still open.
 
 ## Known debt (P2, from the 2026-06-14 full-eval — `EVALUATION.md`)