feat(analyze): report hardcoded theme tokens

[lntutor]

Summary

• add askr/no-hardcoded-theme-token for direct --ak-* literals in runtime JavaScript and TypeScript
• inspect strings, template segments, and JSX attributes while respecting configured source exclusions
• exempt only the exact @askrjs/themes token-owner workspace and document the rule
• move existing SSR and StartKit template token references into CSS so generated projects pass the new rule

Verification

• npm test (203 tests)
• npm run check
• npm run test:templates (all five templates, zero analyzer warnings)
• git diff --check origin/main...HEAD

Closes #48

[lntutor]

Rebased onto current main and resolved the analyzer overlap introduced by #58: the existing askr/no-hardcoded-theme-token rule now preserves upstream hardcoded-color diagnostics while also detecting the issue #48 --ak-* literals, without duplicate rule registration. Fresh npm run check passes, including lint, typecheck, 204 tests with coverage, build, publint, and package dry-run.