FCI theming refresh, contact identity fields, Amplify secrets fix

- Remap globals.css tokens to FCI brand palette (Eggplant #801d7f,
  Spring Pea #96bc33, Seed Grant #679038, Squash #c9ad2d, FCI gray
  #4b5657). Existing leaf-* / clay-* class names preserved.
- Switch body font to Open Sans (FCI's free fallback for Museo Sans).
  Headings keep Fraunces.
- Add contact identity (first name, last name, email) as readonly
  fields at the top of Stage 0. /api/data fetches via APIv4
  Contact.get with email_primary.email join; values flow through
  FormDataPayload.contact and into the form's evalState so the
  readonly renderer displays them. Draft restore re-applies them so
  a stale local draft can't override.
- amplify.yml: fetch Amplify Secrets from SSM Parameter Store when
  they don't arrive as build-shell env vars (the common failure mode
  behind "Refusing to run in production without CIVI_*"). Adds a
  length-only diagnostic echo and a hard-fail guard so a missing
  required var stops the build with a clear message instead of
  bundling empty strings and crashing the SSR Lambda at runtime.

config/form.ts

@@ -68,6 +68,24 @@ const stage0: StageSectionConfig = {
       label: "Current stage",
       type: "readonly",
       optionGroupId: STAGE_OPTION_GROUP_ID,
+    },
+    // Contact identity, sourced from the cid in /api/data. Display-only —
+    // never written back to Civi. These confirm to the form-filler which
+    // contact record their submission will be attributed to.
+    {
+      name: "contact_first_name",
+      label: "First name",
+      type: "readonly",
+    },
+    {
+      name: "contact_last_name",
+      label: "Last name",
+      type: "readonly",
+    },
+    {
+      name: "contact_email",
+      label: "Email",
+      type: "readonly",
     },
 	  //     {
 	  //       name: "Peer_Group_Participation",