refactor(tenants): visibility form requires explicit appearance values

Simplifies the tenant Visibility tab to match the tenant-only appearance
model established by the previous commits:

- primary_color: now required. Removed the "No brand color / Use system
  default (no brand accent)" toggle — every tenant carries a concrete
  primary color. Legacy NULL rows render the neutral app default (#2fa4a4)
  in the color picker and are converted to that explicit hex on save.
- default_theme: the select no longer offers a "Use system default" empty
  option. Legacy NULL rows resolve to 'light' at render time; saves always
  persist a valid theme via SettingsAppGateway::normalizeTheme().
- allow_user_theme: replaced the tri-state "Use system default (allowed) /
  Force allow / Force disallow" select with a single boolean switch
  ("Users may choose their own theme"). Legacy NULL rows load as checked.
  Saves persist 0/1 explicitly.

TenantService: sanitize no longer reads primary_color_use_default or
allow_user_theme_mode; it validates primary_color as a required hex and
treats allow_user_theme as a plain boolean. Both create and update paths
write concrete values only — no more NULL writes for these three fields.

DirectorySettingsGateway gains a normalizeTheme() delegate so TenantService
can route through the same gateway it uses for isAllowedTheme().

Removed now-unused app-color-default-toggle JS component + its runtime
registration + its architecture-test entry. i18n cleanup: "No brand
color", "Use system default (no brand accent)", "When enabled the tenant
renders without a brand accent color.", "Use system default (light)",
"Use system default (allowed)", "Force allow user theme", "Force disallow
user theme", "User theme policy is invalid" all removed. New copy: "Users
may choose their own theme" + helper text, plus a tightened tab blockquote.

Tests: TenantServiceTest validInput() updated to send concrete values;
settingsGateway mock gets normalizeTheme() + isAllowedTheme() defaults.
All 1985 tests pass; PHPStan level 5 clean; QG-006 clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

i18n/default_de.json

@@ -425,13 +425,10 @@
   "Appearance": "Darstellung",
   "API docs": "API-Doku",
   "Can view API documentation": "Kann API-Dokumentation anzeigen",
-  "Appearance is controlled per tenant. If a field is left at the system default, the app renders in light theme without a brand accent.": "Die Darstellung wird pro Mandant gesteuert. Wenn ein Feld auf Systemstandard bleibt, rendert die App im hellen Theme ohne Markenakzent.",
-  "No brand color": "Keine Markenfarbe",
-  "Use system default (no brand accent)": "Systemstandard verwenden (kein Markenakzent)",
-  "When enabled the tenant renders without a brand accent color.": "Wenn aktiv, rendert der Mandant ohne Markenakzent-Farbe.",
-  "Use system default (light)": "Systemstandard verwenden (hell)",
+  "Appearance is controlled per tenant. Every tenant carries its own primary color and default theme.": "Die Darstellung wird pro Mandant gesteuert. Jeder Mandant hat eine eigene Primärfarbe und ein eigenes Standard-Theme.",
   "The theme used for users in this tenant who have no personal preference.": "Das Theme für Nutzer dieses Mandanten, die keine persönliche Präferenz gesetzt haben.",
-  "Use system default (allowed)": "Systemstandard verwenden (erlaubt)",
+  "Users may choose their own theme": "Benutzer dürfen ihr eigenes Theme wählen",
+  "Controls whether users in this tenant can override the tenant default with a personal theme preference.": "Steuert, ob Benutzer dieses Mandanten den Mandanten-Standard durch eine persönliche Theme-Präferenz überschreiben dürfen.",
   "Inactive tenants are excluded from user access and tenant-scoped data.": "Inaktive Mandanten werden vom Benutzerzugriff und mandantenspezifischen Daten ausgeschlossen.",
   "Status & meta": "Status & Meta",
   "Audit": "Audit",
@@ -759,10 +756,7 @@
   "Filterable fields are available in address book filters.": "Filterbare Felder sind im Adressbuch als Filter verfügbar.",
   "Inactive fields are hidden in forms and filters.": "Inaktive Felder sind in Formularen und Filtern ausgeblendet.",
   "Default theme is invalid": "Standard-Theme ist ungültig",
-  "User theme policy is invalid": "Benutzer-Theme-Richtlinie ist ungültig",
   "Theme change is disabled for this tenant": "Theme-Wechsel ist für diesen Mandanten deaktiviert",
-  "Force allow user theme": "Benutzer-Theme erlauben (erzwingen)",
-  "Force disallow user theme": "Benutzer-Theme verbieten (erzwingen)",
   "Controls whether users in this tenant can choose their own theme.": "Steuert, ob Benutzer in diesem Mandanten ihr eigenes Theme wählen können.",
   "Tenants can override color and theme behavior in their appearance settings.": "Mandanten können Farbe und Theme-Verhalten in ihren Darstellungs-Einstellungen überschreiben.",
   "User theme policy": "Benutzer-Theme-Richtlinie",

i18n/default_en.json

@@ -425,13 +425,10 @@
   "Appearance": "Appearance",
   "API docs": "API docs",
   "Can view API documentation": "Can view API documentation",
-  "Appearance is controlled per tenant. If a field is left at the system default, the app renders in light theme without a brand accent.": "Appearance is controlled per tenant. If a field is left at the system default, the app renders in light theme without a brand accent.",
-  "No brand color": "No brand color",
-  "Use system default (no brand accent)": "Use system default (no brand accent)",
-  "When enabled the tenant renders without a brand accent color.": "When enabled the tenant renders without a brand accent color.",
-  "Use system default (light)": "Use system default (light)",
+  "Appearance is controlled per tenant. Every tenant carries its own primary color and default theme.": "Appearance is controlled per tenant. Every tenant carries its own primary color and default theme.",
+  "Users may choose their own theme": "Users may choose their own theme",
+  "Controls whether users in this tenant can override the tenant default with a personal theme preference.": "Controls whether users in this tenant can override the tenant default with a personal theme preference.",
   "The theme used for users in this tenant who have no personal preference.": "The theme used for users in this tenant who have no personal preference.",
-  "Use system default (allowed)": "Use system default (allowed)",
   "Inactive tenants are excluded from user access and tenant-scoped data.": "Inactive tenants are excluded from user access and tenant-scoped data.",
   "Status & meta": "Status & meta",
   "Audit": "Audit",
@@ -759,10 +756,7 @@
   "Filterable fields are available in address book filters.": "Filterable fields are available in address book filters.",
   "Inactive fields are hidden in forms and filters.": "Inactive fields are hidden in forms and filters.",
   "Default theme is invalid": "Default theme is invalid",
-  "User theme policy is invalid": "User theme policy is invalid",
   "Theme change is disabled for this tenant": "Theme change is disabled for this tenant",
-  "Force allow user theme": "Force allow user theme",
-  "Force disallow user theme": "Force disallow user theme",
   "Controls whether users in this tenant can choose their own theme.": "Controls whether users in this tenant can choose their own theme.",
   "Tenants can override color and theme behavior in their appearance settings.": "Tenants can override color and theme behavior in their appearance settings.",
   "User theme policy": "User theme policy",