fix(seo): point the shell's default card at the crest

[Amitoj02]

The API half of a two-repo change. Frontend twin: lords-regiment-dashboard #78 — these must ship together, or the frontend first.

Why

DEFAULT_CARD_IMAGE was banner.png, a frame of Holdfast gameplay. It is the card image for every shell-rendered page with nothing of its own to show — the roster, an empty calendar, the generic card, a member with neither an avatar nor a banner — so all of them unfurled as the same anonymous battlefield under the regiment's name.

What changed

DEFAULT_CARD_IMAGE now names /assets/images/social-card.png: the regiment crest centred on --ink-900 at 1200x630. DEFAULT_CARD_WIDTH/HEIGHT move with it (853x480 → 1200x630) because an unfurler lays the embed out from those numbers before the image fetch lands.

Wide rather than square is deliberate and is explained in the constant's docblock: the crest on its own is 256x256, and Discord inspects the real file and demotes a square image to a thumbnail whatever twitter:card claims. The ink field is what buys the large card.

What deliberately did NOT change

• The /home precedence. presentation.heroBannerUrl → bannerUrl → default is untouched. An owner who has uploaded a hero in Settings has said what that page's card should be; the crest is the answer for a page nobody has spoken for, not an override of one.
• Any page with its own image. An event with a banner, a gallery item, a member with an avatar — all unchanged.

⚠️ Deploy coupling

The asset ships in the Angular build and is served from this origin, so this constant is a cross-repo reference this repo cannot verify. Deployed ahead of the web image it emits a card URL that 404s. banner.png is deliberately still present in the frontend build, so the reverse order (web first) is safe.

Verification

• jest: 1292 tests, 54 suites, all green. The two SEO assertions that pinned banner.png now pin social-card.png.
• eslint + prettier --check clean; tsc --noEmit clean.
• Still pending, needs the deploy: a crawler-UA fetch of /roster and /u/<slug> emitting the new URL, and that URL returning 200.

Blueframe: T-0302.

https://claude.ai/code/session_01QCDE7JStcg5XSdtvuLsLYb