Feat: Polish Angular UI with cohesive design system

Introduces a shared CSS custom property token layer and applies it
across all five views (library, upload, detail, login, app shell).
Each view now has intentional loading, empty, and error states.

- styles.css: 13 design tokens on :root; shimmer skeleton animation
- Library: 150ms-debounced skeleton loading, empty state with /upload
  link, error card with retry, card hover lift, broken-image fallback
- Upload: token-styled drop-zone, Uploading… spinner, 4s success
  banner, distinct validation vs. network error messages
- Detail: image skeleton, network error card (separate from 404
  not-found card), Owner actions panel, danger tag error styling,
  broken-image fallback
- Login: vertically centred surface card, danger field/server errors,
  Signing in… disabled button
- App shell: 48px fixed header, app name left, sign-out right, no
  reflow on auth state change
- All 24 ESLint errors resolved (including pre-existing auth spec
  issues); ng build and ng lint pass clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/app/auth/auth.guard.spec.ts

@@ -6,7 +6,6 @@ import { AuthService } from './auth.service';
 
 describe('authGuard', () => {
   let authService: jasmine.SpyObj<AuthService>;
-  let router: Router;
 
   beforeEach(() => {
     authService = jasmine.createSpyObj('AuthService', ['isAuthenticated']);
@@ -18,8 +17,6 @@ describe('authGuard', () => {
         { provide: AuthService, useValue: authService },
       ],
     });
-
-    router = TestBed.inject(Router);
   });
 
   it('redirects to login when not authenticated', () => {

ui/src/app/auth/auth.interceptor.spec.ts

@@ -1,5 +1,5 @@
 import { TestBed } from '@angular/core/testing';
-import { HttpClient, HttpErrorResponse, provideHttpClient, withInterceptors } from '@angular/common/http';
+import { HttpClient, provideHttpClient, withInterceptors } from '@angular/common/http';
 import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
 import { Router } from '@angular/router';
 import { authInterceptor } from './auth.interceptor';
@@ -48,6 +48,7 @@ describe('authInterceptor', () => {
 
   it('redirects to login on 401 response', () => {
     authService.getToken.and.returnValue('test-token');
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
     http.get('/api/v1/images').subscribe({ error: () => {} });
     const req = httpMock.expectOne('/api/v1/images');
     req.flush('Unauthorized', { status: 401, statusText: 'Unauthorized' });