design: the last VM-side colours come from tokens (ThemeBrush)

The state colours the view-models hand to bindings — top bar, REC/ON-AIR dots, health banner,
meter bands, toast tints — were hex literals in C#. They now resolve from Themes/Tokens.xaml
through `Helpers/ThemeBrush`, so the values live in one place. Without an Application (unit tests)
the helper returns a neutral grey: visibly wrong rather than silently plausible.

Four tokens the code needed and the document lacked, added to DESIGN.md (so the doc-is-the-contract
guard demanded their brushes): info-container #3a3b52, success-container #1d5c38,
warning-container #b8860b, test-container #9c6f1c (the test-stream gold bar).

Also fixed by this: the top bar still painted the RETIRED brand red #e94560 when live — the
standard's #ff5451 now, and `OnAirSignTests` (which pinned the old value) says so. BarOn/BarOff
became properties rather than static fields, because a static field would resolve tokens before
the Application exists.

Verified: DesignTokensTests, GameMeterHonestyTests, NotificationAreaIntegrationTests,
OnAirSignTests, SessionTeardownTests — 38 tests green.

ytLive.Tests/OnAirSignTests.cs

@@ -37,16 +37,16 @@ public sealed class OnAirSignTests
             var vm = new MainViewModel();
 
             Assert.Equal(StreamStatus.Offline, vm.StreamStatus);
-            Assert.Equal("#555555", vm.OnAirBrush);
+            Assert.Equal("#5b6478", vm.OnAirBrush);
 
             var raised = 0;
             vm.PropertyChanged += (_, e) => { if (e.PropertyName == nameof(MainViewModel.OnAirBrush)) raised++; };
 
             vm.StreamVisibility = "Public";
-            Assert.Equal("#555555", vm.OnAirBrush);
+            Assert.Equal("#5b6478", vm.OnAirBrush);
 
             vm.StreamStatus = StreamStatus.Streaming;
-            Assert.Equal("#e94560", vm.OnAirBrush);
+            Assert.Equal("#ff5451", vm.OnAirBrush);
 
             vm.StreamVisibility = "Private";
             Assert.Equal("#22c55e", vm.OnAirBrush);