design: white ink on any accent fill (on-accent token)

The EDIT button's armed face used on-tertiary (#0b1326 navy) on blue — the creator read it as grey
on blue and could not read it. Same problem, latent, on the armed REC/ON-AIR pills, which used the
error ink.

One rule instead of two exceptions: a saturated accent fill carries WHITE ink. New token
on-accent #ffffff, used by the EDIT trigger and RecordPillToggle; on-tertiary stays for large blue
surfaces where dark ink is right. UiShellTests pins the EDIT foreground to it.

DESIGN.md

@@ -43,7 +43,8 @@
 | Token | Hex | Role |
 |---|---|---|
 | `tertiary` (electric blue) | `#38bdf8` | **The** interactive accent: selection, focus, sliders, primary buttons, transform handles |
-| `on-tertiary` | `#0b1326` | Text/icon on a blue fill |
+| `on-tertiary` | `#0b1326` | Dark ink, for large blue **surfaces** only |
+| `on-accent` | `#ffffff` | Text/icon on any saturated accent fill — the blue EDIT button, the armed REC/ON-AIR pills. One rule: a coloured fill carries white ink |
 | `primary` (red) | `#ff5451` | **On-air / recording only** — LIVE badge, program border, End/Go Live |
 | `primary-container` | `#b91a24` | Red pressed/hover state |
 | `secondary` (amber) | `#ffb95f` | Game audio channel, Super Chat highlight |