design: the last VM-side colours come from tokens (ThemeBrush)

The state colours the view-models hand to bindings — top bar, REC/ON-AIR dots, health banner,
meter bands, toast tints — were hex literals in C#. They now resolve from Themes/Tokens.xaml
through `Helpers/ThemeBrush`, so the values live in one place. Without an Application (unit tests)
the helper returns a neutral grey: visibly wrong rather than silently plausible.

Four tokens the code needed and the document lacked, added to DESIGN.md (so the doc-is-the-contract
guard demanded their brushes): info-container #3a3b52, success-container #1d5c38,
warning-container #b8860b, test-container #9c6f1c (the test-stream gold bar).

Also fixed by this: the top bar still painted the RETIRED brand red #e94560 when live — the
standard's #ff5451 now, and `OnAirSignTests` (which pinned the old value) says so. BarOn/BarOff
became properties rather than static fields, because a static field would resolve tokens before
the Application exists.

Verified: DesignTokensTests, GameMeterHonestyTests, NotificationAreaIntegrationTests,
OnAirSignTests, SessionTeardownTests — 38 tests green.

Themes/Tokens.xaml

@@ -43,6 +43,10 @@
     <SolidColorBrush x:Key="Brush.Error" Color="#ef4444"/>
     <SolidColorBrush x:Key="Brush.ErrorContainer" Color="#93000a"/>
     <SolidColorBrush x:Key="Brush.OnError" Color="#ffdad6"/>
+    <SolidColorBrush x:Key="Brush.InfoContainer" Color="#3a3b52"/>
+    <SolidColorBrush x:Key="Brush.SuccessContainer" Color="#1d5c38"/>
+    <SolidColorBrush x:Key="Brush.WarningContainer" Color="#b8860b"/>
+    <SolidColorBrush x:Key="Brush.TestContainer" Color="#9c6f1c"/>
 
     <!-- Colours (for gradients that cannot take a brush) -->
     <Color x:Key="Color.Background">#0b1326</Color>