feat(errors): per-status static error pages for nginx fallback

Adds prerendered, JS-less, self-contained error pages for nginx
error_page use — served directly from /var/www/errors/ when the
SvelteKit upstream is unreachable or any nginx-originated 4xx/5xx
fires (including the catch-all default_server for unknown hosts).

- /errors/[status] (DE default) + /errors/en/[status] (EN), each
  with a header language toggle linking absolute to bocken.org so
  the switch works even on unknown-host fallbacks.
- httpStatus param matcher restricts entries to 401/403/404/500/
  502/503/504; entries() drives prerender output.
- generate-error-quotes.ts looks up curated bilingual references
  in the existing allioli/drb TSV bibles at prebuild time and
  writes src/lib/data/errorQuotes.json.
- build-error-page.ts (postbuild) inlines all CSS, strips module
  preloads/scripts, rewrites the home-link to canonical https URL,
  and emits .html + .gz + .br per status under build/client/errors.
- deploy.sh syncs build/client/errors → /var/www/errors with
  http:http ownership for nginx access.

scripts/deploy.sh

@@ -15,6 +15,8 @@ REMOTE="${REMOTE:-root@bocken.org}"
 REMOTE_DIR="${REMOTE_DIR:-/usr/share/webapps/homepage}"
 REMOTE_USER_GROUP="${REMOTE_USER_GROUP:-homepage:homepage}"
 SERVICE="${SERVICE:-homepage.service}"
+ERROR_PAGES_DIR="${ERROR_PAGES_DIR:-/var/www/errors}"
+ERROR_PAGES_OWNER="${ERROR_PAGES_OWNER:-http:http}"
 
 DRY=""
 if [[ "${1:-}" == "--dry-run" ]]; then
@@ -62,13 +64,23 @@ echo ":: Syncing package.json + pnpm-lock.yaml"
 rsync -az $DRY \
     package.json pnpm-lock.yaml "$REMOTE:$REMOTE_DIR/"
 
+if [[ ! -d build/client/errors ]]; then
+    echo "!! build/client/errors not produced — postbuild error-page step did not run"
+    exit 1
+fi
+
+echo ":: Syncing error pages → $REMOTE:$ERROR_PAGES_DIR/"
+ssh "$REMOTE" "mkdir -p $ERROR_PAGES_DIR"
+rsync -az --delete $DRY --info=progress2 \
+    build/client/errors/ "$REMOTE:$ERROR_PAGES_DIR/"
+
 if [[ -n "$DRY" ]]; then
     echo ":: Dry run complete — no service restart"
     exit 0
 fi
 
 echo ":: Fixing ownership on server"
-ssh "$REMOTE" "chown -R $REMOTE_USER_GROUP $REMOTE_DIR/dist $REMOTE_DIR/node_modules $REMOTE_DIR/static $REMOTE_DIR/package.json $REMOTE_DIR/pnpm-lock.yaml"
+ssh "$REMOTE" "chown -R $REMOTE_USER_GROUP $REMOTE_DIR/dist $REMOTE_DIR/node_modules $REMOTE_DIR/static $REMOTE_DIR/package.json $REMOTE_DIR/pnpm-lock.yaml && chown -R $ERROR_PAGES_OWNER $ERROR_PAGES_DIR"
 
 echo ":: Restarting $SERVICE"
 ssh "$REMOTE" "systemctl restart $SERVICE"