feat: migre le site vers SvelteKit (Svelte 5, statique, zéro tiers)

- Rebuild complet SvelteKit 2 + Svelte 5 runes + TypeScript, adapter-static
- Images self-hébergées optimisées au build (vite-imagetools), fonts Archivo/Inter
  en woff2 local — BunnyCDN et Google Fonts supprimés (corrige les 403 d'images)
- Tokens charte OKI, thème sombre par défaut / clair opt-in, zéro emoji (set SVG)
- Motion : KineticText (stagger syncopé gwoka), ScrollProgressBar, View Transitions
- Village SVG isométrique pour les services hébergés + fallback accessible
- PWA (manifest + SW hors-ligne), 404 en KA, CSP nettoyée (.htaccess + _headers)
- Lighthouse mobile : 91/100/100/100 — JS initial 67 Ko gzip

static/.htaccess

@@ -0,0 +1,50 @@
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    # Redirect HTTP to HTTPS, including behind reverse proxies
+    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
+    RewriteCond %{HTTPS} off
+    RewriteCond %{HTTP:X-Forwarded-Proto} !https
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+</IfModule>
+
+# Page 404 designée (statique, autonome)
+ErrorDocument 404 /404.html
+
+<IfModule mod_headers.c>
+    # Force HTTPS for one year
+    Header always set Strict-Transport-Security "max-age=31536000"
+
+    # Prevent MIME sniffing
+    Header always set X-Content-Type-Options "nosniff"
+
+    # Prevent clickjacking (also enforced via CSP frame-ancestors)
+    Header always set X-Frame-Options "DENY"
+
+    # Control referrer leakage
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    # Restrict browser features
+    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=()"
+
+    # Content Security Policy (no unsafe-inline/unsafe-eval in script-src)
+    # Toutes les ressources sont auto-hebergees : aucun domaine tiers.
+    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
+</IfModule>
+
+# Cache long pour les polices et images optimisees au build
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresByType font/woff2 "access plus 1 year"
+    ExpiresByType image/avif "access plus 1 month"
+    ExpiresByType image/webp "access plus 1 month"
+</IfModule>
+
+# Assets fingerprintes par Vite : cache immutable d'un an
+<IfModule mod_headers.c>
+    <LocationMatch "^/_app/">
+        Header set Cache-Control "public, max-age=31536000, immutable"
+    </LocationMatch>
+    <LocationMatch "^/fonts/">
+        Header set Cache-Control "public, max-age=31536000, immutable"
+    </LocationMatch>
+</IfModule>