feat(5.16+5.17): tipografie/antet branded + tipuri cont, planuri si enforcement

PRD 5.16 — propagare design finalizata (system font stack, fara IBM Plex self-hostat):
- US-001/002/008: tokeni --font-ui/--font-mono (system stack) + scala --fs-*; zero
  @font-face si zero /static/fonts/; landing aliniat la acelasi stack
- US-003: RAR online = dot compact in antet + meniu burger; banda rosie DOAR pe blocat
  (invariant zero-silent-failures pastrat)
- US-010: antet "ROMFAST AUTOPASS" + nume service + /login brandeit 2 coloane + badge plan;
  meniu burger cu separatoare; gate strict pe is_authenticated
- US-011: selector tema pill icon+eticheta (reuse THEMES)
- US-004/005/006/007: bug-fix editor prestatii (picker cod+denumire, add_extra in mod
  operatii, cod ales se salveaza fara "+", Renunta inchide via closest)
- US-012/013: landing Autentificare->/login; wizard import colapsat + 4 pasi pe tokeni
- fix VERIFY E2E: contoare duplicate pe 390px (inline display:flex batea @media) -> CSS + test-lock

PRD 5.17 — tipuri de cont + trial Pro 30z + enforcement DUR:
- US-001/002/008: accounts.tier + trial_until (migrare aditiva defensiva); app/plans.py
  sursa unica (PLANS, FREE_MONTHLY_LIMIT=60, effective_tier(now injectabil), monthly_usage,
  CONSUMED_STATUSES); create_account trial Pro 30z; CLI set-tier (protejat id=1, audit)
- US-003/004/005: enforce volum 60/luna INAINTE de build_key pe ambele canale
  (PLAN_LIMITA_LUNARA, 3 niveluri + log_event); gate API Pro+ (PLAN_FARA_API 403 actionabil);
  valideaza/nomenclator raman permise; downgrade lazy; flag AUTOPASS_ENFORCE_PLANS (kill-switch)
- US-006: badge plan antet + linie burger + consum N/60 + warn>=80% + 6 stari + copy RO
  pluralizat + banner one-time trial->Gratuit + pagina Cont

Regresie: 1380 passed, 0 failed, 1 deselected (live). E2E browser pe 390/1280 confirmat.
Backend trimitere (worker/masina stari/idempotenta/contract RAR) NEATINS. Lucrul 5.18
(corpus kNN) ramane separat, necomis.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_tema.py

@@ -370,3 +370,84 @@ def test_token_critic_in_tema_parametrizat(client, tema, token):
         f"Componentele cu var({token}) vor arata gresit pe aceasta tema. "
         f"Adauga '{token}:<valoare>;' in blocul CSS al temei '{tema}'."
     )
+
+
+# ── US-001 PRD 5.16: Stiva font sistem standard web ───────────────────────────
+
+def test_font_stack_system_in_base(client):
+    """T-E2 (PRD 5.16): base.html DEFINESTE --font-ui si --font-mono in :root
+    si body foloseste var(--font-ui). Niciun @font-face IBM Plex nu mai exista."""
+    resp = client.get("/login")
+    assert resp.status_code == 200
+    html = resp.text
+
+    assert "--font-ui" in html, "Token --font-ui lipseste din :root (US-001 PRD 5.16)"
+    assert "--font-mono" in html, "Token --font-mono lipseste din :root (US-001 PRD 5.16)"
+    assert "var(--font-ui)" in html, "body nu foloseste var(--font-ui) (US-001 PRD 5.16)"
+    assert "@font-face" not in html, \
+        "@font-face inca prezent in base.html — sterge toate regulile IBM Plex (US-001 PRD 5.16)"
+
+
+def test_zero_referinte_static_fonts(client):
+    """T-E1 (PRD 5.16): nicio referinta /static/fonts/ in template-urile randate de app.
+    Toate literalele 'IBM Plex Sans' si 'IBM Plex Mono' sunt eliminate."""
+    resp = client.get("/login")
+    assert resp.status_code == 200
+    html = resp.text
+
+    assert "/static/fonts/" not in html, \
+        "Referinta /static/fonts/ inca prezenta in HTML randat — @font-face nestersi complet"
+    assert "IBM Plex Sans" not in html, \
+        "Literalul 'IBM Plex Sans' inca prezent in HTML — inlocuieste cu var(--font-ui)"
+    assert "IBM Plex Mono" not in html, \
+        "Literalul 'IBM Plex Mono' inca prezent in HTML — inlocuieste cu var(--font-mono)"
+
+
+def test_landing_fara_font_face_ibm_plex():
+    """T-E1 (PRD 5.16): landing.html nu contine @font-face IBM Plex si niciun
+    literal 'IBM Plex Sans' sau 'IBM Plex Mono' ca font primary."""
+    landing = Path(__file__).parent.parent / "app" / "web" / "templates" / "landing.html"
+    assert landing.exists(), f"landing.html negasit la {landing}"
+    content = landing.read_text(encoding="utf-8")
+
+    assert "@font-face" not in content, \
+        "@font-face inca in landing.html — sterge toate regulile IBM Plex (US-008 PRD 5.16)"
+    assert "IBM Plex Sans" not in content, \
+        "Literal 'IBM Plex Sans' inca in landing.html — inlocuieste cu var(--font-ui)"
+    assert "IBM Plex Mono" not in content, \
+        "Literal 'IBM Plex Mono' inca in landing.html — inlocuieste cu var(--font-mono)"
+
+
+# ── US-002 PRD 5.16: Scala tipografica ────────────────────────────────────────
+
+def test_tokeni_scala_fs_definiti(client):
+    """US-002 (PRD 5.16): tokenurile de scala tipografica --fs-xs..--fs-3xl si
+    --lh-tight/--lh-body sunt definiti in :root."""
+    resp = client.get("/login")
+    assert resp.status_code == 200
+    html = resp.text
+
+    tokeni = [
+        "--fs-xs", "--fs-sm", "--fs-base", "--fs-md",
+        "--fs-lg", "--fs-xl", "--fs-2xl", "--fs-3xl",
+        "--lh-tight", "--lh-body",
+    ]
+    for tok in tokeni:
+        assert tok in html, f"Token {tok} lipseste din :root (US-002 PRD 5.16)"
+
+
+# ── US-011 PRD 5.16: Selector tema pill cu eticheta ───────────────────────────
+
+def test_selector_tema_are_eticheta(client):
+    """US-011 (PRD 5.16): butonul de tema este un pill cu clasa .tema-btn,
+    contine .tema-icon si #tema-label (eticheta vizibila a temei curente)."""
+    resp = client.get("/login")
+    assert resp.status_code == 200
+    html = resp.text
+
+    assert "tema-btn" in html, \
+        "Clasa .tema-btn lipseste din HTML — butonul de tema nu e pill (US-011 PRD 5.16)"
+    assert "tema-icon" in html, \
+        ".tema-icon lipseste — iconita temei nu e separat de eticheta (US-011 PRD 5.16)"
+    assert 'id="tema-label"' in html, \
+        '#tema-label lipseste — eticheta temei nu e prezenta in pill (US-011 PRD 5.16)'