fix(ci): load prod deploy secrets from Infisical over GitHub OIDC - #355

🟢 Confidence 9/10 · safe to merge. No defects found; the open risk is whether Infisical prod holds the exact key names the deploy reads.
_{no findings · tests not needed · risk high −1}

The prod deploy now takes every secret from Infisical over GitHub OIDC instead of the empty production environment, and the same PR reworks the web kit's type, surfaces and sidebar states and adds a screenshot gallery. Nothing in it is unsafe to merge.

• deploy-prd.yml exports Infisical prod over OIDC with id-token: write
• Job-level secret list dropped so the action's GITHUB_ENV values survive
• New fg-1..4, wash, field, shadow-control tokens replace accent and input borders
• design.gallery.ts screenshots the kit in light and dark

Before merge

• Env var · Set VITE_GALLERY_LABEL in every environment, or confirm its default · apps/web-foldkit/src/design.gallery.ts:215
• Env var · Add INFISICAL_IDENTITY_ID to the production environment variables · .github/workflows/deploy-prd.yml:52
• Manual · Confirm Infisical prod carries every key the deploy reads (S3_BUCKET, GITHUB_APP_ID, MAPLE_API_KEY); nothing in the diff checks the names

_{0944356 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}