fix: address code review on #27

- The empty state is about an empty library, not a brand-new Reader:
  listView.Fresh becomes EmptyLibrary and moves behind the tab-specific
  branches, so "No favourites yet" is no longer shadowed for a Reader whose
  library happens to be empty. The action key stays put — hiding it was
  never asked for.
- The owner is not a revocable Reader: their row offers no button and
  POST /readers/{owner}/revoke is a 404, so the one row where the control
  would sign out the tapping browser cannot be reached by a hand-rolled
  POST either.
- Modify isolation is asserted in both directions, and the owner's own
  sign-in through the OAuth callback is pinned to the seeded row.
- CUTOVER.md and REDEPLOY.md still grepped API_TOKEN out of .env for their
  smoke tests, which the last commit deleted; both now take the acting
  Reader's derived credential.
- Roster type follows the machine-fact spec (500 10-11px mono, tracked),
  and PRODUCT.md names the Readers panel instead of claiming there is no
  owner surface at all.

backend/internal/web/static/style.css

@@ -301,10 +301,15 @@ button { cursor: pointer; }
   border-top: 1px solid var(--rule);
 }
 .readerlist form { margin: 0 0 0 auto; }
-.reader-id { font: 400 13px/1.4 var(--font-mono); color: var(--paper); }
-.reader-sessions {
-  font: 400 11px/1.4 var(--font-mono);
+.reader-id {
+  font: 500 13px/1.4 var(--font-mono);
   letter-spacing: .04em;
+  color: var(--paper);
+}
+.reader-sessions {
+  font: 500 10px/1 var(--font-mono);
+  letter-spacing: .14em;
+  text-transform: uppercase;
   color: var(--mute);
 }
 /* Revocation cuts someone off, so it wears --danger. Ember stays reserved for