handoff pass: vendored sveltia bundle, astro pinned ^7.2.10, root README + refreshed deploy runbook, review fixes (coverless card grid, shared NewsCard/lib, real site origin, nginx security headers, linger step, dead config removed, preview.css sync, tsconfig)

src/components/NewsCard.astro

@@ -0,0 +1,16 @@
+---
+// The one news card — used by the home page and the /news archive.
+// `featured` (archive page 1, first item) switches the wide lead variant and
+// eager-loads its cover. Cover alt stays empty by design: the image is
+// decorative next to the always-visible title.
+import { fmt, iso, readMin } from '../lib/news.js';
+const { post, featured = false } = Astro.props;
+---
+<article class={featured ? 'card card--featured' : 'card'}>
+  {post.data.cover && <img class="cover" src={encodeURI(post.data.cover)} alt="" loading={featured ? 'eager' : 'lazy'} />}
+  <div class="body">
+    <h3><a href={`/news/${post.id}`}>{post.data.title}</a></h3>
+    <p class="desc">{post.data.description}</p>
+    <div class="meta"><span><svg class="ico" aria-hidden="true" viewBox="0 0 24 24"><rect x="4" y="5" width="16" height="16" rx="2" /><path d="M4 10h16M8 3v4M16 3v4" /></svg><time datetime={iso(post.data.date)}>{fmt(post.data.date)}</time></span><span><svg class="ico" aria-hidden="true" viewBox="0 0 24 24"><circle cx="12" cy="12" r="9" /><path d="M12 7v5l3 2" /></svg>{readMin(post)} min read</span></div>
+  </div>
+</article>