feat: add the MaKo-Prozesse pill to the cross-app solutions footer

[hf-kklein]

Adds a fifth pill — MaKo-Prozesse — to the solutions footer, so this app links to the new
MaKo processes web app alongside the other three. The same pill is being added to AHahnB,
entscheidungsbaumdiagramme and fristenkalender-frontend in parallel PRs.

Design: Hochfrequenz/mako_prozesse → docs/plans/2026-08-11-solutions-footer-design.md.

⚠️ This PR is knowingly non-functional at merge. mako-prozesse.hochfrequenz.de is not
deployed yet — see the merge-gate comment below. The pill will render correctly but lead to a
certificate error until the custom domain is live. Nothing in the diff needs changing for that;
it is purely a sequencing gate.

The pill

<a class="mako" [href]="makoProzesseUrl">MaKo-Prozesse</a>, appended last. The existing four
pills are untouched — not reordered, not relabelled, not refactored into a loop.

makoProzesseUrl follows the existing ebdBaseUrl pattern exactly, across the four
environment*.ts files, the environment.interface.ts declaration, both infra/Pulumi.*.yaml
stacks, and the config read plus appSettings entry in infra/index.ts.

Every environment points at the same production URL, because the app is not deployed under
that host in any environment — there is no staging host to differ from. All six touched files
say so in a comment citing mako_prozesse#65, so a future reader re-checks rather than assuming
it was settled. (An earlier revision of this PR described it as "no staging deployment yet",
which was wrong and would have implied production was fine.)

Why the colour needed two changes, not one

#solutions a.mako { background-color: var(--grell-lila); } alone would have shipped an
invisible white-on-white pill, for two independent reasons:

1. The submodule pin was stale — src/assets/companystylesheet sat one commit behind the
   commit adding the lila variables. Bumped to bdb5667, verified as exactly one commit, one
   file, five added lines, no icons/fonts/build output.
2. The submodule's CSS is never loaded. angular.json's styles array is only
   rose-red.css, src/styles.scss, src/tailwind.css; index.html links no stylesheet; the
   submodule is consumed purely as a static asset directory for SVGs and TTFs.
   src/styles.scss:30 admits it: "copied from …hochfrequenz.css, because I didn't manage to
   import/include it properly". So that :root block is the only runtime definition site for
   every --grell-* token.

So the lila family is also copied into styles.scss's :root — that copy is what makes the
pill purple, the bump keeps the reference honest. All three lila vars came along because every
other --pastell-* in that file is likewise unused; copying complete families keeps the mirror
diffable against upstream.

tailwind.config.js turned out to be a third mirror of these hexes and also lacked lila, so
bg-hf-grell-lila didn't exist for the next person — now added, with a comment naming the
submodule as source of truth and recording that the two mirrors have already drifted
independently (dunkel-mint exists in one and not the other).

Tests

solutions-footer.component.spec.ts was a bare "should create". It now asserts all five links
with labels and hrefs, plus a case pinning the URL literal in every built environment — prod,
stage and docker. That matters because Jest resolves environments/environment to the dev
file, so the literals that actually ship were asserted nowhere.

$ npx jest solutions-footer     → 1 suite, 3 tests passed
$ npx jest                      → 51 suites, 384 tests passed
$ npx eslint <touched paths>     → clean
$ npx tsc -p tsconfig.app.json --noEmit / tsconfig.spec.json --noEmit → both clean
$ npx prettier --end-of-line auto --check <13 touched files> → all clean

Two environment caveats, neither caused by this change: npx ng lint cannot start (Angular CLI
wants Node v22.22.3+/v24.15.0+, this machine has v24.11.1), so eslint was run directly — worth a
maintainer confirming CI lint is green. And Prettier needs --end-of-line auto locally because
core.autocrlf=true fights .prettierrc's endOfLine: lf for every file in the checkout,
proven against untouched src/main.ts. CI on Linux is unaffected.

Known, and deliberate

• infra/index.ts throws if makoProzesseBaseUrl is unset, mirroring ebdBaseUrl. Both in-repo
  stacks carry the key; a stack configured outside this repo would fail its next deploy until it
  is added. The *_BASE_URL app settings are also not read at runtime — start.sh builds
  with --configuration=$ENVIRONMENT, so URLs are baked in from the env files. That is now
  recorded in a comment covering all three, so nobody hunts for a consumer.
• The EBD pill's label stays Entscheidungsbaumdiagramm (singular, unlike the Svelte siblings) —
  Solutions footer: label the EBD pill 'Entscheidungsbaumdiagramme' (plural), as the other apps do #911. Pill labels stay white on pastel (1.51–2.55:1, failing WCAG AA) — a11y: solutions-footer pill labels fail WCAG AA (white on pastel, 1.51-2.55:1) #910. Both deliberately
  out of a pill-addition PR.
• The fallback page still tells users to use "das Kontaktformular im Footer", which fix: remove the dead Kontakt link from the footer #912 removes —
  Fallback page tells users to use a Kontaktformular that no longer exists in the footer #914.

Related issues filed in this repo

• a11y: solutions-footer pill labels fail WCAG AA (white on pastel, 1.51-2.55:1) #910 — solutions-footer pill labels fail WCAG AA (white on pastel, 1.51–2.55:1)
• Solutions footer: label the EBD pill 'Entscheidungsbaumdiagramme' (plural), as the other apps do #911 — the EBD pill is labelled Entscheidungsbaumdiagramm (singular) where the Svelte sibling
  apps use the plural
• Fallback page tells users to use a Kontaktformular that no longer exists in the footer #914 — fallback-page.component.html tells users to use "das Kontaktformular im Footer", which
  no longer exists once the dead link is removed

Design doc: Hochfrequenz/mako_prozesse → docs/plans/2026-08-11-solutions-footer-design.md
(Hochfrequenz/mako_prozesse#73).

[pulumi]

🚀 The Update (preview) for Hochfrequenz/ahb-tabellen/stage (at 3b667ac) was successful.

Resource Changes

    Name          Type                     Operation
~   ahb-tabellen  azure-native:web:WebApp  update

[hf-kklein]

⚠️ Merge gate — the target host is not live yet. No code change needed.

Independent review checked all five app hosts. Four are healthy; the new one is not:

ahb-tabellen.hochfrequenz.de      https:200   [20.105.224.24]
fristenkalender.hochfrequenz.de   https:200   [51.105.228.104]
bedingungsbaum.hochfrequenz.de    https:200   [20.8.24.149]
ebd.hochfrequenz.de               https:200   [20.8.24.149]
mako-prozesse.hochfrequenz.de     TLS failure [198.185.159.144]

mako-prozesse.hochfrequenz.de currently resolves via a *.hochfrequenz.de wildcard to
Squarespace (198.185.159.144), serving a certificate valid only for *.squarespace.com /
*.sqsp.net. Clicking the new pill today produces a full-page
NET::ERR_CERT_COMMON_NAME_INVALID interstitial in a new tab — a worse outcome than the 404
being removed in the companion PR, and one that reads to users as a security problem with
hochfrequenz.de itself.

Two things to confirm before merging:

1. https://mako-prozesse.hochfrequenz.de returns 200 with a valid certificate.
2. The hyphenated spelling is the settled hostname. This matters more than usual: because the
   wildcard catches everything, mako-prozesse, makoprozesse and mako all resolve to the
   same IP with the same failure — so DNS cannot tell a typo from a correct-but-unprovisioned
   name, and the usual "does it load?" smoke test gives the same answer either way. A wrong
   spelling would propagate to five repos unnoticed.

The diff itself was reviewed and found correct — URL string, label, colour value and token
wiring all check out. This is purely a sequencing gate, and it applies identically to the
matching PRs in the other four repos.