perf/privacy: two GitHub Sponsors iframes load before first paint on every one of 421 pages #101

Why it matters
Each page embeds the Sponsors button twice (nav and footer) as an <iframe> pointing at github.com. Every iframe fetches a full GitHub document with its own CSS and JS and sets third-party cookies, in the header, before the catalog has painted. On the home page that competes with a 627 KB HTML document for bandwidth; on an entry page it is the heaviest thing on the page. It also undercuts the "no analytics, links only" privacy story, since GitHub sees every page view.

Evidence

• site/lib/shared.mjs:106-108 sponsorButtonHtml() returns the iframe with no loading, sandbox or referrerpolicy attributes.
• grep -o '<iframe' site/dist/index.html | wc -l → 2; same for site/dist/entry/kenney/index.html.
• Used from site/public/index.html:32 and :216 and by every entry, stack and freshness page.

Suggested approach
Replace the iframe with a static link styled as the existing .btn-ghost (an SVG heart plus "Sponsor"), which is what the README already does. If the live button is wanted, keep one iframe in the footer only, with loading="lazy", sandbox="allow-scripts allow-popups allow-top-navigation-by-user-activation" and referrerpolicy="no-referrer".

Done when
No page makes a request to github.com on load (DevTools Network), and the sponsor link still works from the nav and footer.