design: the last VM-side colours come from tokens (ThemeBrush)

The state colours the view-models hand to bindings — top bar, REC/ON-AIR dots, health banner,
meter bands, toast tints — were hex literals in C#. They now resolve from Themes/Tokens.xaml
through `Helpers/ThemeBrush`, so the values live in one place. Without an Application (unit tests)
the helper returns a neutral grey: visibly wrong rather than silently plausible.

Four tokens the code needed and the document lacked, added to DESIGN.md (so the doc-is-the-contract
guard demanded their brushes): info-container #3a3b52, success-container #1d5c38,
warning-container #b8860b, test-container #9c6f1c (the test-stream gold bar).

Also fixed by this: the top bar still painted the RETIRED brand red #e94560 when live — the
standard's #ff5451 now, and `OnAirSignTests` (which pinned the old value) says so. BarOn/BarOff
became properties rather than static fields, because a static field would resolve tokens before
the Application exists.

Verified: DesignTokensTests, GameMeterHonestyTests, NotificationAreaIntegrationTests,
OnAirSignTests, SessionTeardownTests — 38 tests green.

DESIGN.md

@@ -53,6 +53,10 @@
 | `error` | `#ef4444` | Error text and icons |
 | `error-container` | `#93000a` | Error surface (health banner, toast) — keeps error visually distinct from on-air red |
 | `on-error` | `#ffdad6` | Text on an error surface |
+| `info-container` | `#3a3b52` | Neutral notice surface (info toast) |
+| `success-container` | `#1d5c38` | Success notice surface (success toast) |
+| `warning-container` | `#b8860b` | Warning surface — health banner, warning toast |
+| `test-container` | `#9c6f1c` | Test-stream chrome: the gold top bar and glow |
 
 **The rule:** red means "live or recording" and nothing else. Never a Send button, a delete action,
 a brand flourish, or a general accent — that was the defect in the first Stitch draft.