ci: add merge-blocking perf gates — Locust p95 smoke + Lighthouse-CI

[ChelseaKR]

Closes the "Performance (Quality §2)" deferred gate: reliability's
restart-recovery + kosync-down tests were already merge-blocking via
tests/test_reliability.py, but load smoke and Lighthouse-CI were missing.

• tests/perf/locustfile.py: a demo-auth Locust scenario hitting / and
  /readyz.
• scripts/perf-smoke.sh (make perf-load): boots the app in demo mode,
  runs the scenario headlessly, and fails closed if the aggregated p95
  is >= 500ms. Verified locally (p95 ~15ms; a threshold=0 run correctly
  exits non-zero).
• .lighthouserc.json (make lighthouse): runs Lighthouse-CI against the
  built docs/audits/dashboard.html with categories:performance >= 0.9
  and categories:accessibility >= 1.0 as error-level assertions.
• Fixed a real color-contrast bug the new Lighthouse gate caught:
  app/render.py relied on implicit link-color defaults under
  color-scheme: light dark, which Chrome resolved inconsistently
  against the page background (2.38:1, needs 4.5:1). Pairing
  Canvas/CanvasText/LinkText/VisitedText system colors fixes it — both
  categories now score 1.0.
• Wired both as non-conditional, blocking steps in ci.yml; added locust
  to the dev extra in pyproject.toml.
• Marked both roadmap gates done in docs/ROADMAP-FUTURE.md.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Backfill PR for a completed roadmap item (roadmap/performance-reliability-merge-blocking-g, 1 commit(s) over main). Part of the portfolio roadmap batch.