NL-UI-01: Bring public archive and unsubscribe page onto the newsletter.org brand

Visual QA + polish on the public newsletter UI (/p, /p/{domain}, /p/{domain}/{slug} and the unsubscribe confirmation). No structural rewrite — same routes, data fetching, and iframe article rendering. Fixes - Archive pages forced fontFamily: 'system-ui' via inline styles, overriding the Geist font set in layout.tsx. Header/footer rendered in Geist while page body rendered in the OS default. Converted all three pages to the same Tailwind brand idiom as the home page (cream #f0ede5 canvas, ink #4f4b44, accent #c83f49). - Cards had no hover affordance (inline styles can't express :hover). Now match home: hover:border-[#c83f49]/40 + shadow. - /p/{domain}/{slug} rendered the raw DB error message to the public page. Replaced with generic copy. - Empty and error states on /p and /p/{domain} were bare low-contrast sentences with no next step. Now distinct panels (red-tinted for errors, dashed for empty) each with a CTA. - Unsubscribe GET confirmation was a plain system-ui #111 page. Now uses the brand palette, logo, Geist, and a CTA; still returns 400 for invalid links. Not changed - SubscribeCard / dashboard were already on brand. - NL-02 host/sitemap wiring untouched. - Plain <a> links kept to match repo convention (no-html-link-for-pages is pre-existing across app/). Verified: tsc, next build, and production-serve screenshots of all four pages.