refactor(settings): remove global appearance settings — tenant is sole source

Removes the global app_theme, app_theme_user and app_primary_color settings
from the admin/settings area and the underlying service/cache/API/i18n/docs
layers. The tenant columns (tenants.primary_color, default_theme,
allow_user_theme) become the single source of truth for appearance.
Branding helpers are tenant-only and fall back to a hardcoded 'light' theme
with no brand color when no tenant context is available (login, error,
pre-session pages). The APP_THEME env var is removed.

Scope:
- UI: Appearance tab gone from /admin/settings; tenant edit form drops the
  global-fallback color preview.
- Service: SettingsAppGateway no longer exposes setting-backed accessors
  for theme/user-theme/primary-color. Theme catalog utilities (listThemes,
  isAllowedTheme, normalizeTheme, resolveDefaultTheme) stay and are used
  across Tenant / Auth / User flows; resolveDefaultTheme now hardcodes
  'light' with a catalog fallback (no global/env lookup).
- AdminSettingsService: buildPageData, sanitization, audit snapshot, apply
  step and cache payload are all stripped of the three keys. Dead helper
  applyAppPrimaryColor + normalizePrimaryColor removed.
- Cache: SettingCacheService HOT_PATH_KEYS drops the three keys.
- API: /settings (GET/PUT) and /settings/public (GET) no longer expose
  appearance fields; OpenAPI schemas pruned accordingly.
- Audit redaction list shortened.
- DB: db/init/init.sql seed rows removed. No migration for existing
  installs — legacy rows stay inert.
- i18n + docs: setting.app_theme, setting.app_theme_user,
  setting.app_primary_color removed from de+en locales; reference and
  explanation docs updated.
- Tests: covering tests for the removed methods pruned; ThemeResolutionTest
  rewritten for tenant-only semantics. One unrelated PHP-CS-Fixer issue in
  UserRegistrar.php cleaned up to keep QG-006 green.

Workflow: .agents/runs/SETTINGS-APPEARANCE-TENANT-ONLY/ (gitignored).
Gates: QG-001..003, QG-006, QG-008 all pass (1985 tests, 28764 assertions).
Reviews: code, security, acceptance all pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/api/v1/settings/index().php

@@ -59,13 +59,13 @@ if ($method === 'PUT' || $method === 'PATCH') {
         $settingsSmtpGateway,
     );
 
+    // Appearance settings (theme, user-theme toggle, primary color) are NOT
+    // accepted here — they are tenant-scoped. See the tenant edit endpoints
+    // for per-tenant appearance overrides.
     $setters = [
         'app_title' => static fn (?string $v) => $settingsAppGateway->setAppTitle($v),
         'app_locale' => static fn (?string $v) => $settingsAppGateway->setAppLocale($v),
-        'app_theme' => static fn (?string $v) => $settingsAppGateway->setAppTheme($v),
-        'app_theme_user_allowed' => static fn ($v) => $settingsAppGateway->setUserThemeAllowed((bool) $v),
         'app_registration_enabled' => static fn ($v) => $settingsAppGateway->setRegistrationEnabled((bool) $v),
-        'app_primary_color' => static fn (?string $v) => $settingsAppGateway->setAppPrimaryColor($v),
         'api_token_default_ttl_days' => static fn ($v) => $settingsApiPolicyGateway->setApiTokenDefaultTtlDays($v !== null ? (int) $v : null),
         'api_token_max_ttl_days' => static fn ($v) => $settingsApiPolicyGateway->setApiTokenMaxTtlDays($v !== null ? (int) $v : null),
         'api_cors_allowed_origins' => static fn (?string $v) => $settingsApiPolicyGateway->setApiCorsAllowedOrigins($v),
@@ -150,10 +150,7 @@ function buildSettingsResponse(
     return [
         'app_title' => $settingsAppGateway->getAppTitle(),
         'app_locale' => $settingsAppGateway->getAppLocale(),
-        'app_theme' => $settingsAppGateway->getAppTheme(),
-        'app_theme_user_allowed' => $settingsAppGateway->isUserThemeAllowed(),
         'app_registration_enabled' => $settingsAppGateway->isRegistrationEnabled(),
-        'app_primary_color' => $settingsAppGateway->getAppPrimaryColor(),
         'api_token_default_ttl_days' => $settingsApiPolicyGateway->getApiTokenDefaultTtlDays(),
         'api_token_max_ttl_days' => $settingsApiPolicyGateway->getApiTokenMaxTtlDays(),
         'api_cors_allowed_origins' => $settingsApiPolicyGateway->getApiCorsAllowedOrigins(),

pages/api/v1/settings/public().php

@@ -11,11 +11,11 @@ $settingsAppGateway = app(SettingsAppGateway::class);
 
 header('Cache-Control: public, max-age=60');
 
+// Appearance (theme, primary color) is tenant-scoped — the public settings
+// endpoint exposes only the non-tenant, non-appearance surface.
 ApiResponse::success([
     'data' => [
         'app_title' => $settingsAppGateway->getAppTitle(),
-        'app_primary_color' => $settingsAppGateway->getAppPrimaryColor(),
-        'default_theme' => $settingsAppGateway->getAppTheme(),
         'registration_enabled' => $settingsAppGateway->isRegistrationEnabled(),
     ],
 ]);