404 search + category pillar intros

[rivassec]

This PR bundles two related landing-page improvements. The pillar-intro copy in Part B is a DRAFT for review - see the flag below.

Part A: 404 page rebuilt around Pagefind search

A mistyped URL now lands on a recovery page instead of a two-link dead end.

• New custom template themes/Flex/templates/404.html extends base.html, mirroring pagefind_search.html: it loads pagefind-ui.css in the meta block and pagefind-ui.js + the external search-init.js in additional_js.
• The search box targets the same #search div that search-init.js initializes, so the site-wide Pagefind index is reused as-is.
• Curated static links (home, DevSecOps guide, all categories, full search page) replace the old two links. Pelican page templates get no articles context, so these are intentionally static, not a dynamic recent-posts list.
• content/pages/404.md now sets Template: 404. The page stays Status: hidden, so base.html emits noindex, nofollow and it stays out of the sitemap.
• No inline scripts or styles - csp_audit.py passes.

Part B: category pillar intros with links

• category.html now renders CATEGORY_INTROS[...] through the |safe filter (autoescape was turning HTML/links into literal text). Every intro carries its own <p> blocks for consistency.
• Expanded the three well-populated categories (DevSecOps 15 posts, Threat Intelligence 2, Projects 2) into 1-2 paragraph pillar intros that describe the cluster and link key posts with absolute https://rivassec.com/<slug>.html URLs (config strings cannot resolve {filename}).
• Single-post categories (Kubernetes Security, Incident Retrospectives) keep their one-line intros, wrapped in <p>.

REVIEW FLAG: the pillar-intro copy is a draft. Please check voice and the specific posts linked before merge.

Verification

Built with pelican content -o output -s publishconf.py. All green:

• output/404.html has the #search div, references /pagefind/pagefind-ui.js and /theme/js/search-init.js, carries noindex, nofollow, no canonical, and no inline script code.
• output/category/{devsecops,threat-intelligence,projects}.html render the intros with working <a> links (0 escaped-link occurrences).
• Pass: csp_audit, check_canonical_noindex, check_wellknown_llms, check_link_graph, check_descriptions, check_em_dashes, check_anchors, and python3 -m unittest discover tests (38 tests OK).