design: the last VM-side colours come from tokens (ThemeBrush)

The state colours the view-models hand to bindings — top bar, REC/ON-AIR dots, health banner,
meter bands, toast tints — were hex literals in C#. They now resolve from Themes/Tokens.xaml
through `Helpers/ThemeBrush`, so the values live in one place. Without an Application (unit tests)
the helper returns a neutral grey: visibly wrong rather than silently plausible.

Four tokens the code needed and the document lacked, added to DESIGN.md (so the doc-is-the-contract
guard demanded their brushes): info-container #3a3b52, success-container #1d5c38,
warning-container #b8860b, test-container #9c6f1c (the test-stream gold bar).

Also fixed by this: the top bar still painted the RETIRED brand red #e94560 when live — the
standard's #ff5451 now, and `OnAirSignTests` (which pinned the old value) says so. BarOn/BarOff
became properties rather than static fields, because a static field would resolve tokens before
the Application exists.

Verified: DesignTokensTests, GameMeterHonestyTests, NotificationAreaIntegrationTests,
OnAirSignTests, SessionTeardownTests — 38 tests green.

ViewModels/MainViewModel.Streaming.cs

@@ -29,7 +29,7 @@ public partial class MainViewModel : ViewModelBase
     private string? _healthIssueBanner;
     private string _healthIssueBackground = "Transparent";
     private string _windowTitle = "LlamaCasty";
-    private string _topBarBackground = "#16213e";
+    private string _topBarBackground = ThemeBrush.Hex("Brush.SurfaceContainer");
     private string _previewGlowBrush = "Transparent";
     private Thickness _previewGlowThickness = new(0);
     private string _liveElapsedText = "00:00:00";
@@ -87,10 +87,18 @@ public partial class MainViewModel : ViewModelBase
     public bool IsOffline => StreamStatus == StreamStatus.Offline;
     public bool IsLive => StreamStatus == StreamStatus.Streaming;
     public bool IsLivePrivate => IsLive && string.Equals(StreamVisibility, "Private", StringComparison.OrdinalIgnoreCase);
-    public string RecDotBrush => !IsRecording ? "#555555" : "#ff5451";
-    public string RecTextBrush => (IsLive || IsRecording) ? "#ffffff" : "#888888";
+    public string RecDotBrush => !IsRecording
+        ? ThemeBrush.Hex("Brush.OnSurfaceDisabled")
+        : ThemeBrush.Hex("Brush.Primary");
+    public string RecTextBrush => (IsLive || IsRecording)
+        ? ThemeBrush.Hex("Brush.OnSurface")
+        : ThemeBrush.Hex("Brush.OnSurfaceDisabled");
     public double RecDotOpacity => IsRecording ? _recDotPulse : 0.55;
-    public string OnAirBrush => !IsLive ? "#555555" : IsLivePrivate ? "#22c55e" : "#ff5451";
+    public string OnAirBrush => !IsLive
+        ? ThemeBrush.Hex("Brush.OnSurfaceDisabled")
+        : IsLivePrivate
+            ? ThemeBrush.Hex("Brush.Positive")
+            : ThemeBrush.Hex("Brush.Primary");
 
     // ─── REC / ON-AIR pills (TASK 18) ───
     public bool RecordPillOn
@@ -222,7 +230,11 @@ public partial class MainViewModel : ViewModelBase
     /// <summary>Reality dot color, one meaning per mode: gold = test, red = live,
     /// green = recording. The pre-spec pulsing lamp never shipped; the word + bar
     /// color carry the state and the dot just pins it.</summary>
-    public string RunningDotBrush => IsTestStream ? "#9c6f1c" : IsLive ? "#ff5451" : "#22c55e";
+    public string RunningDotBrush => IsTestStream
+        ? ThemeBrush.Hex("Brush.TestContainer")
+        : IsLive
+            ? ThemeBrush.Hex("Brush.Primary")
+            : ThemeBrush.Hex("Brush.Positive");
 
     /// <summary>Raises every flag the top bar renders, so any state change re-renders
     /// exactly the world that is now true.</summary>
@@ -273,8 +285,8 @@ public partial class MainViewModel : ViewModelBase
         private set => SetProperty(ref _healthIssueBanner, value);
     }
 
-    /// <summary>Banner background: app red (#8f1f1f) for an error issue, amber
-    /// (#b8860b) for a warning. Transparent when no banner is shown.</summary>
+    /// <summary>Banner background: the error surface for an error issue, the warning surface
+    /// for a warning (both tokens). Transparent when no banner is shown.</summary>
     public string HealthIssueBackground
     {
         get => _healthIssueBackground;