feat(01-04): audit inline style attributes — close D-13 evasion path (GREEN)

- implementation pages' style="…" attributes are rendered CSS: every
  declaration checked like <style>-block CSS, violations reported as
  file:line: style attribute { prop: value }
- token-var references pass by construction; only off-token literals flag
- 16/16 audit tests green; real build still AUDIT CLEAN

theme/scripts/audit.mjs

@@ -521,6 +521,22 @@ for (const p of pages) {
     const contentOffset = m.index + m[0].indexOf('>') + 1;
     pageStyleInputs.push({ text: m[1], display: `${displayPath(abs)} <style>`, baseOffset: contentOffset, lineText: text });
   }
+  /* Inline style="…" attributes are rendered CSS too — audited so no
+   * declaration path around the <style>-block scan exists. */
+  for (const m of text.matchAll(/\bstyle\s*=\s*"([^"]*)"|\bstyle\s*=\s*'([^']*)'/g)) {
+    const attr = m[1] ?? m[2] ?? '';
+    const attrOffset = m.index + m[0].indexOf(attr);
+    for (const d of declarations(attr)) {
+      const decl = splitDecl(d.text);
+      if (!decl) continue;
+      state.totals.decls++;
+      for (const reason of checkDeclaration(decl.prop, decl.value, state.tokens)) {
+        state.violations.push(
+          `${displayPath(abs)}:${lineAt(text, attrOffset + d.offset)}: style attribute { ${decl.prop}: ${decl.value} } — ${reason}`,
+        );
+      }
+    }
+  }
 }
 
 /* CSS file inputs. */