FCI theming refresh, contact identity fields, Amplify secrets fix

- Remap globals.css tokens to FCI brand palette (Eggplant #801d7f,
  Spring Pea #96bc33, Seed Grant #679038, Squash #c9ad2d, FCI gray
  #4b5657). Existing leaf-* / clay-* class names preserved.
- Switch body font to Open Sans (FCI's free fallback for Museo Sans).
  Headings keep Fraunces.
- Add contact identity (first name, last name, email) as readonly
  fields at the top of Stage 0. /api/data fetches via APIv4
  Contact.get with email_primary.email join; values flow through
  FormDataPayload.contact and into the form's evalState so the
  readonly renderer displays them. Draft restore re-applies them so
  a stale local draft can't override.
- amplify.yml: fetch Amplify Secrets from SSM Parameter Store when
  they don't arrive as build-shell env vars (the common failure mode
  behind "Refusing to run in production without CIVI_*"). Adds a
  length-only diagnostic echo and a hard-fail guard so a missing
  required var stops the build with a clear message instead of
  bundling empty strings and crashing the SSR Lambda at runtime.

amplify.yml

@@ -9,10 +9,63 @@ applications:
             # Tailwind plugins which live in devDependencies; without it,
             # NODE_ENV=production in the Amplify env causes npm to skip them.
             - npm ci --include=dev --cache .npm --prefer-offline
-            # Amplify exposes Environment Variables + Secrets in the build
-            # shell but does NOT inject them into the SSR Lambda runtime.
-            # Write them to .env.production so Next.js bundles them into
-            # the server output. .env* is gitignored.
+            # Amplify exposes Environment Variables in the build shell as
+            # plain `$VAR` references, but Secrets are SecureString entries
+            # in SSM Parameter Store at `/amplify/<appId>/<branch>/<name>`
+            # and are NOT always injected automatically into the build
+            # shell on older build images. If a Secret is unset as an env
+            # var, fall back to fetching it from SSM directly.
+            #
+            # Once resolved, the values get baked into .env.production so
+            # Next bundles them into the SSR Lambda. .env* is gitignored.
+            - |
+              # Try SSM for any of these that arrive empty (they were set
+              # via the Amplify Secrets tab, not Environment variables).
+              # Requires the Amplify build role to have ssm:GetParameter on
+              # /amplify/$AWS_APP_ID/$AWS_BRANCH/*  — granted by default.
+              fetch_secret() {
+                local name="$1"
+                local current="${!name}"
+                if [ -n "$current" ]; then return 0; fi
+                local path="/amplify/${AWS_APP_ID}/${AWS_BRANCH}/${name}"
+                local val
+                val=$(aws ssm get-parameter --name "$path" --with-decryption \
+                  --query "Parameter.Value" --output text 2>/dev/null || true)
+                if [ -n "$val" ] && [ "$val" != "None" ]; then
+                  export "$name=$val"
+                  echo "[secrets] $name resolved from SSM ($path)"
+                fi
+              }
+              for v in CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN; do
+                fetch_secret "$v"
+              done
+            - |
+              # Length-only diagnostic (no values leaked to the log).
+              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_USER CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN; do
+                val="${!v}"
+                if [ -n "$val" ]; then
+                  echo "[env check] $v set (${#val} chars)"
+                else
+                  echo "[env check] $v UNSET"
+                fi
+              done
+            - |
+              # Required-vars guard. Fails the build now (with a clear
+              # message) instead of letting an empty .env.production crash
+              # the SSR Lambda at runtime with "Refusing to run in
+              # production" from lib/env.ts.
+              missing=""
+              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY; do
+                if [ -z "${!v}" ]; then missing="$missing $v"; fi
+              done
+              if [ -n "$missing" ]; then
+                echo "::error::Amplify build env missing required vars:$missing"
+                echo "Confirm: (1) the var is in the Amplify console under either"
+                echo "Hosting → Environment variables OR Hosting → Secrets;"
+                echo "(2) it is scoped to branch '${AWS_BRANCH}' (or All branches);"
+                echo "(3) the Amplify build role can read /amplify/${AWS_APP_ID}/${AWS_BRANCH}/* from SSM."
+                exit 1
+              fi
             - |
               {
                 echo "CIVI_BASE_URL=$CIVI_BASE_URL"