refactor(tenants): visibility form requires explicit appearance values

Simplifies the tenant Visibility tab to match the tenant-only appearance
model established by the previous commits:

- primary_color: now required. Removed the "No brand color / Use system
  default (no brand accent)" toggle — every tenant carries a concrete
  primary color. Legacy NULL rows render the neutral app default (#2fa4a4)
  in the color picker and are converted to that explicit hex on save.
- default_theme: the select no longer offers a "Use system default" empty
  option. Legacy NULL rows resolve to 'light' at render time; saves always
  persist a valid theme via SettingsAppGateway::normalizeTheme().
- allow_user_theme: replaced the tri-state "Use system default (allowed) /
  Force allow / Force disallow" select with a single boolean switch
  ("Users may choose their own theme"). Legacy NULL rows load as checked.
  Saves persist 0/1 explicitly.

TenantService: sanitize no longer reads primary_color_use_default or
allow_user_theme_mode; it validates primary_color as a required hex and
treats allow_user_theme as a plain boolean. Both create and update paths
write concrete values only — no more NULL writes for these three fields.

DirectorySettingsGateway gains a normalizeTheme() delegate so TenantService
can route through the same gateway it uses for isAllowedTheme().

Removed now-unused app-color-default-toggle JS component + its runtime
registration + its architecture-test entry. i18n cleanup: "No brand
color", "Use system default (no brand accent)", "When enabled the tenant
renders without a brand accent color.", "Use system default (light)",
"Use system default (allowed)", "Force allow user theme", "Force disallow
user theme", "User theme policy is invalid" all removed. New copy: "Users
may choose their own theme" + helper text, plus a tightened tab blockquote.

Tests: TenantServiceTest validInput() updated to send concrete values;
settingsGateway mock gets normalizeTheme() + isAllowedTheme() defaults.
All 1985 tests pass; PHPStan level 5 clean; QG-006 clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/Architecture/FrontendRuntimeContractSupport.php

@@ -24,7 +24,6 @@ trait FrontendRuntimeContractSupport
             'web/js/components/app-confirm-actions.js',
             'web/js/components/app-details-state.js',
             'web/js/components/app-tenant-switcher.js',
-            'web/js/components/app-color-default-toggle.js',
             'web/js/components/app-custom-field-options-toggle.js',
             'web/js/components/app-tenant-sso-toggle.js',
             'web/js/components/app-settings-telemetry.js',

tests/Service/Tenant/TenantServiceTest.php

@@ -23,6 +23,9 @@ class TenantServiceTest extends TestCase
         $this->tenantRepository = $this->createMock(TenantRepositoryInterface::class);
         $this->departmentRepository = $this->createMock(DepartmentRepositoryInterface::class);
         $this->settingsGateway = $this->createMock(DirectorySettingsGateway::class);
+        $this->settingsGateway->method('isAllowedTheme')->willReturn(true);
+        $this->settingsGateway->method('normalizeTheme')
+            ->willReturnCallback(static fn (?string $t): string => $t ?? 'light');
         $this->systemAuditService = $this->createMock(AuditRecorderInterface::class);
 
         $this->service = new TenantService(
@@ -196,10 +199,9 @@ class TenantServiceTest extends TestCase
             'website' => '',
             'privacy_url' => '',
             'imprint_url' => '',
-            'primary_color' => '',
-            'primary_color_use_default' => true,
-            'default_theme' => '',
-            'allow_user_theme_mode' => '',
+            'primary_color' => '#2fa4a4',
+            'default_theme' => 'light',
+            'allow_user_theme' => '1',
         ];
     }
 }