chore(admin): draw the catalogue and the vat rates with components only

[haribo]

Summary

The last 24 raw table, thead, tr, th, td, ul and li elements leave src/surfaces/. Two surface components — ProductTable and VatRateTable — translate a product and a rate into typed cells; Table renders them and knows neither.

The lint ban is closed on those elements, with a message naming ADR 0004, and ADR 0003's table of forbidden markup gains the row. Verified that it refuses: a <table> planted in a surface produced four errors naming the ADR.

The rendering does not change — proven, not asserted

This epic moves markup; it does not restyle. Captured the same catalogue screen on develop and on this branch and compared them pixel by pixel:

desktop-light  355 differing of 921600  (0.039 %)  columns 707–760, rows 166–174
desktop-dark   348 differing of 921600  (0.038 %)  columns 707–760, rows 166–174

One region, and it is a fix.

The comparison found a bug I shipped in #88

font: is a shorthand that resets font-family. The typography migration replaced font-size with font: where the size stood — sometimes below a font-family, which the shorthand then undid. Three rules were affected, and all three lost their monospace face silently:

Rule	Effect on develop
CatalogueView .reference	the merchant reference rendered in the system face
GalleryMenu a	same, in the gallery menu
GallerySection .name	same, on every component name

Neither the type check, nor lint, nor reading the screenshots caught it. The pixel comparison did.

The first commit fixes the two gallery rules and teaches the guard the rule: npm run lint:type now refuses any font: declared after a font-family, verified against a planted failure. The catalogue's rule needed no fix — it is deleted, since the cell owns the reference now.

Dead CSS removed

Seven rules in CatalogueView and one in VatRates described cards and columns these files no longer render. Left behind they would read as current, which is worse than absent.

Tests

Four existing tests interrogated markup selectors — td.reference, .state, td.percent, .default — that the generic table does not produce. Modified with the user's explicit approval, after checking the behaviour was intact, and each is stricter than before:

• the absent reference: was td.reference === '—'; now asserts a dash appears and that no undefined or null reaches the screen — two faults it used to allow;
• the state: was .state === 'Draft'; now also asserts no raw draft key is shown;
• the percentages: only read the first cell, through a variable that a rewrite had left dangling; now reads both, including 5.5 % — the fractional one, which is why basis points exist.

None depends on markup any more, so none will break on the next migration.

Test plan

• just frontend-check — typecheck, lint, theme tokens, type scale
• just frontend-test — 190 tests in 24 files
• just frontend-build
• just e2e — desktop-light 4, desktop-dark 4, mobile-light 5
• Pixel comparison against develop, above

Backend untouched, so backend-check, backend-test and api-check do not apply.

One i18n key added, settings.rates.title, in both languages: the rates table needs an accessible name and had none. Not visible on screen.

Part of #81. Closes #85