feat(proxy-status): serve status over browse-origin real cert + AA contrast

[0pcom]

Two follow-ups to the per-proxy status pages (#4050). Both confirmed live (pages render, interstitial spam gone).

1. HTTPS without a browser cert warning (real wildcard cert)

proxystatus was HTTP-only — served in-process through the resolving proxies' SOCKS splice at bare hosts (status.skysocks / .dmsg / .skynet). So https://status.skysocks/ would only be warning-free if the self-signed skynetca CA is installed.

This wires the same status pages through the browse-origin listener (pkg/visor/meshproxy.go, gated by BrowseOrigin.Enable), which already terminates TLS with the deployment's real wildcard cert (BrowseOrigin.TLSCert/TLSKey, or a fronting Caddy) under BrowseOrigin.Suffix (e.g. .haltingstate.net). The status hosts are reached at a single-label name so a single-level wildcard (*.<suffix>) covers them:

https://status-skysocks.haltingstate.net/
https://status-dmsg.haltingstate.net/
https://status-skynet.haltingstate.net/

meshStatusHandler intercepts these on the browse-origin mux (both subdomain and port modes) before the reverse proxy, renders the same proxystatus page, and lets every other (browse-frame) host fall through. This is the real-cert alternative to the name-constrained skynetca leaf path in pkg/skynetweb — no CA install needed. When browse-origin is disabled/unconfigured, the plain-HTTP SOCKS path remains the fallback.

Naming rationale: the wildcard is single-level, so status-<surface>.<suffix> is covered but a multi-label host is not — the matcher rejects multi-label hosts accordingly (also keeps status from ever shadowing a real <vhost>.<pk><suffix> browse frame).

Verifiable vs. not: the host-matcher, handler wiring, and fallthrough are unit-tested (meshStatusSurface). What I can't verify in this environment is the end-to-end https:// handshake against the live *.haltingstate.net cert — that depends on the deployment's BrowseOrigin cert/Caddy config, which isn't present here. The TLS termination itself is unchanged (serveMeshHTTP already served the browse frames over that cert); this change only adds a host route on the same listener, so it inherits whatever cert path the deployment already uses.

2. WCAG AA contrast fix

The dark status page's muted grey (--muted:#7a80a8) and the light-mode greys were near/below AA for body text. Changes (identity — accent gradient etc. — untouched):

• --muted → dark #a2a8cc (~8:1 on --bg), light #4a4f63;
• light-mode --ok/--warn/--standby darkened (their dark-mode brights are illegible on white);
• the two hardcoded near-white tokens (h2, .surface) get a light-mode override so they aren't invisible on light bg;
• .seam opacity .75 → .9.

Every text token (pills, table headers, .hint/.empty, log pre, footer, status words) now clears ≥4.5:1 in both schemes, locked by a WCAG-contrast unit test (TestContrastAA).

Scope / testing

Contained to pkg/proxystatus (CSS + tests) and pkg/visor/meshproxy.go (+ matcher test); pkg/router/policy untouched. go build ., go vet, formatted with the repo's goimports -local. New/updated unit tests pass (proxystatus, meshStatusSurface, TestContrastAA).

Follow-up (separate PR, same series): streaming the interstitial's real route-setup progress via chunked transfer-encoding.