Embeddable widgets #21

Why

Teams want to put their HackProof card in their own README or site.

What to build

• Web routes /embed/project/:id and /embed/timeline: no header or footer (a separate layout from components/layout/), fixed sizes (600x200 and 800x400), light and dark through ?theme=.
• An SVG badge, GET /api/badge/project/{id}.svg, rendered server side in FastAPI (no JavaScript): name, evidence tier, contracts count.
• A "copy embed" button on the project page (pages/project.tsx) that copies the iframe and the SVG markdown.
• Make sure /embed/* can be framed: check vercel.json and any response headers.

Acceptance criteria

• The SVG renders in a GitHub README (test it by embedding one in this repo's README).
• The iframe works from a page on another origin.

See CONTRIBUTING.md for conventions.