Content-shipped stylesheet override (site.yaml stylesheet)

A content repo can now ship a CSS file named in site.yaml's
stylesheet field; portal serves it same-origin at /site/<path> and
leptos_meta appends it after the default stylesheet so content rules
win. Plain repo-relative .css path only, validated on load.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y42TyF8Zu7NGRR2893vNcZ

src/content.rs

@@ -527,6 +527,11 @@ pub struct SiteConfig {
     /// `None` means "en"; unknown codes fall back to English per key.
     #[serde(default)]
     pub lang: Option<String>,
+    /// A content-repo-relative CSS file (e.g. "custom.css") layered
+    /// *after* the default stylesheet, so it overrides. Served
+    /// same-origin at `/site/<path>`; plain path only.
+    #[serde(default)]
+    pub stylesheet: Option<String>,
     #[serde(default)]
     pub hero: HeroConfig,
 }
@@ -582,6 +587,13 @@ impl SiteConfig {
             }
             other => anyhow::bail!("site.yaml: hero.kind {other:?} is not one of plain | module"),
         }
+        if let Some(sheet) = &self.stylesheet {
+            if !is_safe_site_path(sheet) || !sheet.ends_with(".css") {
+                anyhow::bail!(
+                    "site.yaml: stylesheet {sheet:?} must be a plain repo-relative .css path"
+                );
+            }
+        }
         Ok(())
     }
 }