ui: keep the board visible in light mode + bust diagram cache

Light mode: revert the heavy white-out scrim back to a moderate wash so the
board stays visible, and earn legibility with a soft light text-halo behind
running text instead (invisible on the solid cards, only works over the image).
Pairs with the darker light-mode text tokens.

Also append ?v=2 to every /diagrams/*.svg reference so the recoloured diagrams
bypass Cloudflare's 4h edge cache and show immediately (the SVG URLs aren't
content-hashed like the CSS bundle).

src/content/blog/authentik-sso-2fa.md

@@ -13,7 +13,7 @@ and you've hardened the whole estate at once. Get it wrong and you've built a si
 
 Here's how I think about it after wiring an OIDC provider in front of a self-hosted fleet.
 
-![Authentik SSO flow — the browser authenticates against the identity provider over the front channel; each app validates tokens over an internal back channel](/diagrams/authentik-sso.svg)
+![Authentik SSO flow — the browser authenticates against the identity provider over the front channel; each app validates tokens over an internal back channel](/diagrams/authentik-sso.svg?v=2)
 
 ## Enforce the second factor at the flow, not per app