Optimize: drop Bootstrap CDN, add caching headers & image hints

Performance / self-hosting
- Remove the render-blocking Bootstrap 4 CDN stylesheet (~160 KB + extra
  DNS/TLS to a third party) and replace it with ~60 lines of self-hosted
  grid/utility CSS covering the small subset actually used (container, row,
  col-lg-5/6/7, order-lg, align-items-center, text-center, table-responsive,
  spacing, and the button base). Verified across desktop/tablet/mobile.
- Add a Cloudflare Pages `_headers` file: 30-day cache for static media and
  icons, 1-day for css/js, plus baseline security headers
  (X-Content-Type-Options, Referrer-Policy).
- Add decoding="async" to all lazily-loaded images.

The site now loads no third-party CSS; only Google Fonts remain external.
SCSS source kept in sync (new components/_grid partial; button base + reset
mirrored in main.scss).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

_headers

@@ -0,0 +1,22 @@
+# Cache-Control for static, stable-by-filename assets
+/img/*
+  Cache-Control: public, max-age=2592000
+/favicon.svg
+  Cache-Control: public, max-age=2592000
+/favicon-16.png
+  Cache-Control: public, max-age=2592000
+/favicon-32.png
+  Cache-Control: public, max-age=2592000
+/apple-touch-icon.png
+  Cache-Control: public, max-age=2592000
+
+# CSS/JS have no cache-busting hash yet; cache modestly
+/css/*
+  Cache-Control: public, max-age=86400
+/js/*
+  Cache-Control: public, max-age=86400
+
+# Baseline security headers on every response
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin