refactor(web-ui): reduce theme color literal duplication

[limityan]

Related: #1197

Summary

• Consolidates exact duplicate and mechanically equivalent color literals across theme presets, root token contracts, ThemeService runtime fallbacks, and Mermaid theme fallbacks.
• Keeps built-in theme preset output stable while moving repeated palette references through shared helpers and constants.
• Tightens the theme color governance baseline and updates the optimization document to the current audit numbers.
• Documents the theme extension boundary: Rust/desktop owns only startup bootstrap projection and persisted selection reading; TS/web-ui owns the full theme schema, presets, runtime injection, custom themes, specialized render domains, and audit contracts.

Impact

• Color literal occurrences drop from 1702 to 780; unique color literals drop from 912 to 560.
• Theme preset scope drops from 1019/611 to 231/205 occurrences/unique colors.
• Token contract occurrences drop from 267 to 176; Mermaid occurrences drop from 139 to 105; ThemeService runtime occurrences drop from 54 to 45.
• Specialized near-color queue drops from 35/644 to 6/377 indistinguishable/near pairs, while ordinary app/component raw colors and near pairs remain at 0.
• The design document now makes future theme extension location explicit and identifies the next large de-duplication step: generate the Rust startup theme projection from TS-owned presets instead of maintaining a parallel backend palette.

Risk Controls

• Preset hash tests confirm built-in theme objects remain stable after helper refactors.
• Similar but role-sensitive colors are preserved, including the Slate purple alpha ramp versus solid stop and Mermaid renderer role colors.
• No new CSS var contract debt: unresolved vars, fallback-only vars, unregistered dynamic families, non-contract cross-file vars, token-equivalent app literals, and internal compatibility alias reads all remain at 0.
• The Rust/TS ownership rules keep custom theme schema, Monaco/Mermaid/terminal palettes, widget payload keys, and semantic/component token expansion in TS, while Rust remains limited to first-paint fallback behavior.

Validation

• pnpm --dir src/web-ui run test:run
• node --test scripts/audit-theme-colors.test.mjs
• pnpm run theme:color-audit:test
• pnpm run theme:color-audit -- --top 12
• pnpm run theme:color-audit -- --top 20
• pnpm run theme:visual-contract
• pnpm run lint:web
• pnpm run type-check:web
• pnpm run build:web
• git diff --check

[limityan]

Independent architecture re-review update:

• Design boundary rechecked: this PR does not add Rust-side theme schema or duplicate backend theme ownership. Full ThemeConfig, presets, runtime CSS var injection, widget payload contracts, Mermaid/theme exception domains, and audit registries remain TS/web-ui owned.
• Dynamic CSS variable risk rechecked: runtime setProperty("--...") families are still covered by the audit contract; the latest audit reports unregisteredDynamicFamilies=0, staleRegisteredDynamicFamilies=0, unresolved=0, requiredMissing=0, and generated widget payload undefined=0.
• Color reduction safety rechecked: the changed preset/shared helpers are value-formatting abstractions, not semantic merges. Built-in preset output remains covered by the theme preset snapshot test; token and Mermaid SCSS extraction preserves compiled output intent.
• Validation completed: pnpm run lint:web, pnpm run type-check:web, pnpm --dir src/web-ui run test:run (221 files / 1252 tests), pnpm run build:web, pnpm run theme:color-audit:test, pnpm run theme:color-audit -- --top 20, pnpm run theme:visual-contract, and git diff --check all pass. GitHub CI is green across Frontend Build and Rust Build Check on ubuntu/windows/macos.

No code fix was required from this re-review.