fix(ratewise): 收斂 Nitro 設計 token 覆蓋

[s123104]

摘要

• 補齊 Nitro legacy primary token、語義色彩 alias 與 focus ring offset，避免設定頁深色主題露出淺底或白色 ring。
• 將 html / body / critical bootstrap / applyTheme 收斂到 STYLE_DEFINITIONS 與 design token SSOT。
• 新增 table-driven drift guard，防止 bootstrap map、critical skeleton vars、runtime theme map 再次漂移。
• 新增 patch changeset 與 002 獎懲紀錄。

驗證

• pnpm --filter @app/ratewise test -- src/config/design-tokens.test.ts src/config/__tests__/theme-consistency.test.ts
• pnpm --filter @app/ratewise typecheck
• pnpm exec prettier --check apps/ratewise/index.html apps/ratewise/tailwind.config.ts apps/ratewise/src/index.css apps/ratewise/src/config/design-tokens.ts apps/ratewise/src/config/design-tokens.test.ts apps/ratewise/src/config/themes.ts .changeset/ratewise-nitro-token-ssot.md docs/dev/002_development_reward_penalty_log.md
• pnpm --filter @app/ratewise build
• Production preview smoke：Chromium desktop / WebKit iPhone 15，確認 Nitro html/body background、color-scheme: dark、surface、primary active/ring 與 ring offset。
• Commit hook：pre-commit 5 步驟通過。
• Push hook：typecheck、pnpm test、pnpm build:ratewise 通過。

已知殘留

• Production preview 仍會出現既有 React #418 hydration console error；本 PR 的 token / critical CSS smoke 已通過，該項留給後續 SSG/PWA hydration PR 處理。

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/ratewise-production-governance.yml

Package	Version	License	Issue Type
actions/checkout	6.*.*	Null	Unknown License
actions/setup-node	6.*.*	Null	Unknown License
pnpm/action-setup	6.*.*	Null	Unknown License

Denied Licenses:

GPL-3.0, AGPL-3.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	6.*.*	🟢 5.7	Details Check Score Reason Maintained ⚠️ 0 1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 8 SAST tool detected but not run on all commits
actions/actions/setup-node	6.*.*	🟢 5.8	Details Check Score Reason Maintained 🟢 7 9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 9 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
actions/pnpm/action-setup	6.*.*	🟢 5.3	Details Check Score Reason Code-Review 🟢 3 Found 10/30 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/ratewise-production-governance.yml

[github-actions]

✅ SEO 審計通過！所有 2026 標準驗證項目都符合要求。

• ✅ Sitemap 2026 標準
• ✅ Breadcrumb Schema
• ✅ JSON-LD 結構化數據
• ✅ 內部連結結構

[github-actions]

Lighthouse Production Baseline ✅

• 狀態：pass
• 目標網址：https://app.haotool.org/ratewise/
• 實際執行：3 次
• 退化容忍：5%
• Baseline 更新時間：2026-05-16T17:30:11.981Z

檢查細節

• 無異常，指標符合要求