feat: broaden landing page and restore catalog - #9

Summary

Follow-up to #8 after that PR merged while this requested revision was in review.

• broaden the landing page from a crypto-first funding story into a public workshop for early ideas
• introduce all six catalog categories, three practical participation paths, and four proof-before-scale questions
• retain explicit exploration-mode, no-payments, and no-fundraising boundaries
• restore the live catalog and detail routes during the security-column migration rollout

Catalog failure

The deployed client requested threat_scenario, control_boundary, and proof_required before those columns were available in the connected Supabase schema, producing “Unable to load ideas. Please try again”.

The service now retries the existing legacy projection only when Postgres/PostgREST returns 42703 or PGRST204 and the error specifically names one of those three columns. Unrelated initial errors and all fallback errors still throw. RLS, status filters, slug matching, ordering, relationships, aggregate interest RPC behavior, and privacy boundaries are unchanged.

Landing page

• frames Ideascape as a public workshop rather than a transaction product
• balances arts and culture, community, education, environment, health, and technology
• spotlights clean-air and neighborhood-culture concepts in the hero
• explains how to draft, signal interest, and add grounded context
• asks whose problem is being addressed, what the smallest useful test is, what must remain protected, and what evidence changes the plan
• removes smart-contract, wallet, multisig, and on-chain language from the landing page

Verification

• independent fail-closed review: approved exact staged artifact with no blockers
• npm run check — 190/190 tests passed across 30 files
• npm run format:check — passed
• npm run build — passed
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities
• palette contract and compiled build — passed
• git diff --check — passed
• light and dark landing-page browser QA — passed
• live-compatible local browser QA — all 21 ideas loaded and a detail route rendered against the current remote Supabase database

Safety

No authentication, authorization, RLS, privacy, route, identifier, or interest-aggregation behavior is weakened. The compatibility path is temporary-safe and disappears naturally once the migrated projection succeeds.