fix(ci): make the explorer job and cargo audit gate actually pass

[Depo-dev]

Brings PR #565 (merged into staging/pr565-integration, not dev) into dev together with fixes for the gaps it shipped with. #565 merged with no CI checks reported, and both gates it adds fail as merged.

cargo audit

• .cargo/audit.toml wrote its ignore list as { id, reason } tables — that is cargo-deny syntax. cargo-audit wants an array of advisory-ID strings and exits with invalid type: map, expected a string. With continue-on-error removed, the Dependency audit job died on a fatal parse error before scanning anything. Rewrote the list as ID strings and moved each rationale into the comment above its entry.
• Dropped yanked = "warn", which is not a valid [advisories] key.
• The triage missed RUSTSEC-2026-0258 (h2 unbounded empty DATA frames), published after Triage 10 cargo-audit advisories surfaced by the first real Dependency audit run #373 was filed. Upgraded h2 0.4.15 -> 0.4.19 on the hyper 1.x path, which clears it. The remaining hit is h2 0.3.27 reached through tonic 0.11 -> hyper 0.14, where the 0.3 line has no patched release, so it is ignored with that rationale until tonic is upgraded.
• Synced deny.toml and corrected its "10 advisories" comment; the list is 12 entries.

cargo audit now exits 0.

Explorer

• npm ci could not resolve: @astrojs/tailwind@6.0.2 peers astro ^3||^4||^5 but the project is on astro 7, so the job failed on its first real step. @astrojs/tailwind is EOL at 6.0.2 and will not support astro 7, so migrated to @tailwindcss/vite with tailwindcss 4, added the global stylesheet Tailwind 4 requires, and dropped tailwind.config.mjs after moving its font-mono stack into an @theme block.
• src/pages/contract/[address]/index.astro carried a botched conflict resolution: a duplicated frontmatter block and a second, older <Base> template, giving the file three --- fences. astro build failed with "Unexpected token". Kept the newer template (the one wired to ErrorState/getErrorState) and removed the stale copy.
• Fixed four pre-existing type errors that fail astro check: a11y-test used checkA11y, which returns void and throws, to collect results — it now uses getViolations. perf-test lost null-narrowing on a let assigned inside a callback. Also removed a dead EmptyState import.
• Added the npm cache to the job, matching the other Node jobs.

Verification

npm ci, npm run build and npm run lint all pass; astro check reports 0 errors and 0 warnings. cargo audit exits 0, and cargo check --workspace --all-targets and cargo fmt --check are clean.

Note: deny.toml keeps yanked = "deny" while two yanked crates (chacha20, spin) are pulled in transitively. No workflow runs cargo-deny today, so it is dormant — flagging it rather than changing security posture that was not asked about.