feat: PostW5 Wave C — type plateau + Hangar refresh reframe

C1 — type hierarchy plateau (audit v2 §03)
- `main h1 { font-size: 28px }` in globals.css drops the default
  browser 2em (~32px) baseline for every page that doesn't override
  inline. Inner pages stop competing with top-of-funnel surfaces.
- Removed the inline `fontSize: 32` overrides on /admin/sharing
  and /admin/sharing/audit so those (deeper) pages inherit the
  smaller baseline. /sharing keeps its inline 32 — it's a top-level
  user surface and is the only remaining "page tier" h1.
- Net result: 2-tier plateau. Top-level pages stay loud (32px via
  opt-in inline); inner pages settle at 28px by default. Detail
  pages can opt into a smaller tier later by setting inline
  `fontSize: 24`.

HangarCard — refresh reframe (audit v2 §08)
- Dropped the TODO that promised a parallel inline "Refresh now"
  button to ProfileCard/OrgsCard. That button can't truthfully
  exist: the server holds zero RSI credentials by design — only
  the tray (RSI cookie in the OS keychain) can pull a fresh
  pledges page without breaking that trust boundary.
- Replaced with a subtle "Updated via tray · open Devices →"
  link in the card header, framing the refresh path the user
  actually has rather than a fake button. Doc comment now
  explains the constraint instead of marking it pending.

Held back (out of audit scope this wave)
- C2 (eyebrow reduction) — `ss-eyebrow` appears in 45 files. A
  bulk delete needs the audit doc's "which to keep" rule to
  avoid over-pruning the design language. Surfaced as a future
  audit-by-page rather than guessed here.

Checks: pnpm typecheck clean.

Author: Nigel Tatschner

apps/web/src/app/admin/sharing/audit/page.tsx

@@ -211,7 +211,6 @@ export default async function AdminSharingAuditPage(props: {
         <h1
           style={{
             margin: 0,
-            fontSize: 32,
             fontWeight: 600,
             letterSpacing: '-0.02em',
           }}

apps/web/src/app/admin/sharing/page.tsx

@@ -93,7 +93,6 @@ export default async function AdminSharingOverviewPage() {
         <h1
           style={{
             margin: 0,
-            fontSize: 32,
             fontWeight: 600,
             letterSpacing: '-0.02em',
           }}

apps/web/src/app/globals.css

@@ -65,6 +65,11 @@ main {
 
 main h1 {
   margin-top: 0;
+  /* Audit v2 §03 type plateau: drop the default browser 2em (~32px)
+     down to 28px so inner pages don't compete with top-of-funnel
+     surfaces. Top-level pages that want the louder 32px set it
+     inline; detail pages can opt into a smaller tier the same way. */
+  font-size: 28px;
 }
 
 .muted {

apps/web/src/components/HangarCard.tsx

@@ -9,15 +9,13 @@ import type { HangarSnapshot } from '@/lib/api';
  * without launching the tray. The empty state nudges users who haven't
  * paired the tray yet, since that's the only writer.
  *
- * TODO(audit-v2 §08): ProfileCard + OrgsCard got promoted to inline
- * "Refresh now" buttons backed by server actions. Hangar can't follow
- * suit yet — there's no `refreshHangar()` in `apps/web/src/lib/api.ts`
- * because the tray client is the only writer of `/v1/me/hangar`. Once
- * a server-side refresh endpoint exists, mirror the ProfileCard
- * pattern: import a `refreshHangarAction` from
- * `@/app/_actions/refresh-rsi`, gate on owner-side state, and render
- * `<RefreshSubmitButton />` in the card header. Until then, the empty
- * state's "Pair a device" link is the only refresh affordance.
+ * No inline "Refresh now" button (unlike ProfileCard / OrgsCard): the
+ * server holds zero RSI credentials by design — only the tray, running
+ * on the user's machine and reading the RSI cookie out of the OS
+ * keychain, can pull a fresh pledges page without breaking that trust
+ * boundary. So the affordance is a tray-launch hint ("Updated via tray
+ * · open Devices") rather than a Server Action — the truthful framing
+ * of where the refresh actually happens.
  */
 
 const SHIP_PREVIEW_LIMIT = 6;
@@ -101,8 +99,30 @@ export function HangarCard({
 
   return (
     <section className="ss-card ss-card-pad">
-      <div className="ss-eyebrow" style={{ marginBottom: 6 }}>
-        Hangar
+      <div
+        style={{
+          display: 'flex',
+          justifyContent: 'space-between',
+          alignItems: 'baseline',
+          gap: 12,
+          marginBottom: 6,
+        }}
+      >
+        <div className="ss-eyebrow">Hangar</div>
+        {/* Truthful refresh affordance — the tray is the only writer
+            (RSI cookie sits in the OS keychain), so the link points at
+            the device-pairing surface rather than promising a
+            web-side refresh that can't exist. */}
+        <Link
+          href="/devices"
+          style={{
+            fontSize: 11,
+            color: 'var(--fg-muted)',
+            textDecoration: 'none',
+          }}
+        >
+          Updated via tray · open Devices →
+        </Link>
       </div>
       <h2
         style={{