refactor(settings): remove global appearance settings — tenant is sole source

Removes the global app_theme, app_theme_user and app_primary_color settings
from the admin/settings area and the underlying service/cache/API/i18n/docs
layers. The tenant columns (tenants.primary_color, default_theme,
allow_user_theme) become the single source of truth for appearance.
Branding helpers are tenant-only and fall back to a hardcoded 'light' theme
with no brand color when no tenant context is available (login, error,
pre-session pages). The APP_THEME env var is removed.

Scope:
- UI: Appearance tab gone from /admin/settings; tenant edit form drops the
  global-fallback color preview.
- Service: SettingsAppGateway no longer exposes setting-backed accessors
  for theme/user-theme/primary-color. Theme catalog utilities (listThemes,
  isAllowedTheme, normalizeTheme, resolveDefaultTheme) stay and are used
  across Tenant / Auth / User flows; resolveDefaultTheme now hardcodes
  'light' with a catalog fallback (no global/env lookup).
- AdminSettingsService: buildPageData, sanitization, audit snapshot, apply
  step and cache payload are all stripped of the three keys. Dead helper
  applyAppPrimaryColor + normalizePrimaryColor removed.
- Cache: SettingCacheService HOT_PATH_KEYS drops the three keys.
- API: /settings (GET/PUT) and /settings/public (GET) no longer expose
  appearance fields; OpenAPI schemas pruned accordingly.
- Audit redaction list shortened.
- DB: db/init/init.sql seed rows removed. No migration for existing
  installs — legacy rows stay inert.
- i18n + docs: setting.app_theme, setting.app_theme_user,
  setting.app_primary_color removed from de+en locales; reference and
  explanation docs updated.
- Tests: covering tests for the removed methods pruned; ThemeResolutionTest
  rewritten for tenant-only semantics. One unrelated PHP-CS-Fixer issue in
  UserRegistrar.php cleaned up to keep QG-006 green.

Workflow: .agents/runs/SETTINGS-APPEARANCE-TENANT-ONLY/ (gitignored).
Gates: QG-001..003, QG-006, QG-008 all pass (1985 tests, 28764 assertions).
Reviews: code, security, acceptance all pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/admin/settings/index(default).phtml

@@ -19,8 +19,6 @@ $defaultRoleId = (int) ($values['default_role_id'] ?? 0);
 $defaultDepartmentId = (int) ($values['default_department_id'] ?? 0);
 $appTitle = (string) ($values['app_title'] ?? '');
 $appLocale = (string) ($values['app_locale'] ?? '');
-$appTheme = (string) ($values['app_theme'] ?? '');
-$appThemeUser = !empty($values['app_theme_user']);
 $appRegistration = !empty($values['app_registration']);
 $apiTokenDefaultTtlDays = (int) ($values['api_token_default_ttl_days'] ?? 90);
 $apiTokenMaxTtlDays = (int) ($values['api_token_max_ttl_days'] ?? 365);
@@ -50,10 +48,8 @@ $frontendTelemetryAllowedEvents = array_values(array_unique(array_filter(array_m
 if ($frontendTelemetryAllowedEvents === []) {
   $frontendTelemetryAllowedEvents = ['warn_once', 'ajax_error'];
 }
-$appPrimaryColor = (string) ($values['app_primary_color'] ?? '');
 $microsoftSharedClientId = (string) ($values['microsoft_shared_client_id'] ?? '');
 $microsoftAuthority = (string) ($values['microsoft_authority'] ?? '');
-$themes = appThemes();
 $smtpHost = (string) ($values['smtp_host'] ?? '');
 $smtpPort = (string) ($values['smtp_port'] ?? '');
 $smtpUser = (string) ($values['smtp_user'] ?? '');
@@ -67,8 +63,6 @@ $defaultRoleDesc = $settings['default_role']['description'] ?? 'setting.default_
 $defaultDepartmentDesc = $settings['default_department']['description'] ?? 'setting.default_department';
 $appTitleDesc = $settings['app_title']['description'] ?? 'setting.app_title';
 $appLocaleDesc = $settings['app_locale']['description'] ?? 'setting.app_locale';
-$appThemeDesc = $settings['app_theme']['description'] ?? 'setting.app_theme';
-$appThemeUserDesc = $settings['app_theme_user']['description'] ?? 'setting.app_theme_user';
 $appRegistrationDesc = $settings['app_registration']['description'] ?? 'setting.app_registration';
 $apiTokenDefaultTtlDaysDesc = $settings['api_token_default_ttl_days']['description'] ?? 'setting.api_token_default_ttl_days';
 $apiTokenMaxTtlDaysDesc = $settings['api_token_max_ttl_days']['description'] ?? 'setting.api_token_max_ttl_days';
@@ -81,7 +75,6 @@ $rememberTokenLifetimeDaysDesc = $settings['remember_token_lifetime_days']['desc
 $apiCorsAllowedOriginsDesc = $settings['api_cors_allowed_origins']['description'] ?? 'setting.api_cors_allowed_origins';
 $systemAuditEnabledDesc = $settings['system_audit_enabled']['description'] ?? 'setting.system_audit_enabled';
 $systemAuditRetentionDaysDesc = $settings['system_audit_retention_days']['description'] ?? 'setting.system_audit_retention_days';
-$appPrimaryColorDesc = $settings['app_primary_color']['description'] ?? 'setting.app_primary_color';
 $microsoftSharedClientIdDesc = $settings['microsoft_shared_client_id']['description'] ?? 'setting.microsoft_shared_client_id';
 $microsoftSharedClientSecretDesc = $settings['microsoft_shared_client_secret_enc']['description'] ?? 'setting.microsoft_shared_client_secret_enc';
 $microsoftAuthorityDesc = $settings['microsoft_authority']['description'] ?? 'setting.microsoft_authority';
@@ -126,7 +119,6 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
       <div class="app-tabs" data-tabs data-app-component="tabs" data-tabs-param="tab" data-tabs-storage-key="admin-settings-tabs-v1">
         <div class="app-tabs-nav">
           <button type="button" data-tab="master-data" data-tab-default><?php e(t('Master data')); ?></button>
-          <button type="button" data-tab="appearance"><?php e(t('Appearance')); ?></button>
           <button type="button" data-tab="security"><?php e(t('Security')); ?></button>
           <button type="button" data-tab="email"><?php e(t('Email')); ?></button>
           <button type="button" data-tab="api"><?php e(t('API')); ?></button>
@@ -254,68 +246,6 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
           </details>
         </div>
 
-        <div data-tab-panel="appearance">
-          <details class="app-details-card" name="settings-appearance-theme" data-details-key="settings-appearance-theme" open>
-            <summary>
-              <span class="app-details-card-summary-title"><?php e(t('Theme policy')); ?></span>
-              <span class="app-details-card-summary-meta">
-                <span class="badge" data-variant="neutral"><?php e($appTheme !== '' ? t($themes[$appTheme] ?? $appTheme) : t('Default')); ?></span>
-                <span class="badge" data-variant="neutral"><?php e($appThemeUser ? t('User override enabled') : t('User override disabled')); ?></span>
-              </span>
-            </summary>
-            <div class="app-details-card-container">
-              <blockquote data-variant="info">
-                <small><?php e(t('This setting controls the global default theme and whether users may choose their own theme.')); ?></small>
-              </blockquote>
-              <label class="app-field">
-                <span><?php e(t('Default theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-                <select name="app_theme" <?php e($disabledAttr); ?>>
-                  <option value=""><?php e(t('None')); ?></option>
-                  <?php foreach ($themes as $key => $label): ?>
-                    <option value="<?php e($key); ?>" <?php e($appTheme === $key ? 'selected' : ''); ?>>
-                      <?php e(t($label)); ?>
-                    </option>
-                  <?php endforeach; ?>
-                </select>
-                <small><?php e(t($appThemeDesc)); ?></small>
-              </label>
-              <fieldset>
-                <legend><small><?php e(t($appThemeUserDesc)); ?></small></legend>
-                <label class="app-field">
-                  <input type="checkbox" role="switch" name="app_theme_user" value="1" <?php e($appThemeUser ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
-                  <span><?php e(t('Allow user theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-                </label>
-              </fieldset>
-              <small class="muted"><?php e(t('Tenants can override color and theme behavior in their appearance settings.')); ?></small>
-            </div>
-          </details>
-
-          <details class="app-details-card" name="settings-appearance-branding" data-details-key="settings-appearance-branding">
-            <summary>
-              <span class="app-details-card-summary-title"><?php e(t('Brand color')); ?></span>
-              <span class="app-details-card-summary-meta">
-                <span class="badge" data-variant="neutral"><?php e($appPrimaryColor !== '' ? strtoupper($appPrimaryColor) : t('Default')); ?></span>
-              </span>
-            </summary>
-            <div class="app-details-card-container">
-              <blockquote data-variant="info">
-                <small><?php e(t('This setting controls the primary UI accent color for the default app theme.')); ?></small>
-              </blockquote>
-              <fieldset>
-                <legend><small><?php e(t('Primary color')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></small></legend>
-                <label class="app-field">
-                  <input type="color" name="app_primary_color"
-                    value="<?php e($appPrimaryColor !== '' ? $appPrimaryColor : '#2fa4a4'); ?>" <?php e($disabledAttr); ?>>
-                  <div>
-                    <div><?php e(t('Choose color')); ?></div>
-                  </div>
-                </label>
-                <small class="muted"><?php e(t($appPrimaryColorDesc)); ?></small>
-              </fieldset>
-            </div>
-          </details>
-        </div>
-
         <div data-tab-panel="security">
           <details class="app-details-card" name="settings-security-registration" data-details-key="settings-security-registration">
             <summary>

pages/admin/tenants/_form.phtml

@@ -35,7 +35,9 @@ $readonlyAttr = $isReadOnly ? 'readonly' : '';
 $disabledAttr = $isReadOnly ? 'disabled' : '';
 $themes = appThemes();
 $primaryColor = (string) ($values['primary_color'] ?? '');
-$defaultPrimaryColor = appSetting('app_primary_color') ?? '#2fa4a4';
+// No global fallback — appearance is tenant-scoped. The color picker's
+// "use default" preview uses a neutral hex so the UI is never empty.
+$defaultPrimaryColor = '#2fa4a4';
 $useDefaultPrimaryColor = $primaryColor === '';
 $tenantDefaultTheme = strtolower(trim((string) ($values['default_theme'] ?? '')));
 if ($tenantDefaultTheme !== '' && !isset($themes[$tenantDefaultTheme])) {

pages/api/v1/settings/index().php

@@ -59,13 +59,13 @@ if ($method === 'PUT' || $method === 'PATCH') {
         $settingsSmtpGateway,
     );
 
+    // Appearance settings (theme, user-theme toggle, primary color) are NOT
+    // accepted here — they are tenant-scoped. See the tenant edit endpoints
+    // for per-tenant appearance overrides.
     $setters = [
         'app_title' => static fn (?string $v) => $settingsAppGateway->setAppTitle($v),
         'app_locale' => static fn (?string $v) => $settingsAppGateway->setAppLocale($v),
-        'app_theme' => static fn (?string $v) => $settingsAppGateway->setAppTheme($v),
-        'app_theme_user_allowed' => static fn ($v) => $settingsAppGateway->setUserThemeAllowed((bool) $v),
         'app_registration_enabled' => static fn ($v) => $settingsAppGateway->setRegistrationEnabled((bool) $v),
-        'app_primary_color' => static fn (?string $v) => $settingsAppGateway->setAppPrimaryColor($v),
         'api_token_default_ttl_days' => static fn ($v) => $settingsApiPolicyGateway->setApiTokenDefaultTtlDays($v !== null ? (int) $v : null),
         'api_token_max_ttl_days' => static fn ($v) => $settingsApiPolicyGateway->setApiTokenMaxTtlDays($v !== null ? (int) $v : null),
         'api_cors_allowed_origins' => static fn (?string $v) => $settingsApiPolicyGateway->setApiCorsAllowedOrigins($v),
@@ -150,10 +150,7 @@ function buildSettingsResponse(
     return [
         'app_title' => $settingsAppGateway->getAppTitle(),
         'app_locale' => $settingsAppGateway->getAppLocale(),
-        'app_theme' => $settingsAppGateway->getAppTheme(),
-        'app_theme_user_allowed' => $settingsAppGateway->isUserThemeAllowed(),
         'app_registration_enabled' => $settingsAppGateway->isRegistrationEnabled(),
-        'app_primary_color' => $settingsAppGateway->getAppPrimaryColor(),
         'api_token_default_ttl_days' => $settingsApiPolicyGateway->getApiTokenDefaultTtlDays(),
         'api_token_max_ttl_days' => $settingsApiPolicyGateway->getApiTokenMaxTtlDays(),
         'api_cors_allowed_origins' => $settingsApiPolicyGateway->getApiCorsAllowedOrigins(),

pages/api/v1/settings/public().php

@@ -11,11 +11,11 @@ $settingsAppGateway = app(SettingsAppGateway::class);
 
 header('Cache-Control: public, max-age=60');
 
+// Appearance (theme, primary color) is tenant-scoped — the public settings
+// endpoint exposes only the non-tenant, non-appearance surface.
 ApiResponse::success([
     'data' => [
         'app_title' => $settingsAppGateway->getAppTitle(),
-        'app_primary_color' => $settingsAppGateway->getAppPrimaryColor(),
-        'default_theme' => $settingsAppGateway->getAppTheme(),
         'registration_enabled' => $settingsAppGateway->isRegistrationEnabled(),
     ],
 ]);