refactor(theme): tighten runtime token contracts

[limityan]

Summary

• Retire unused root/runtime theme keys, including legacy size aliases, unused modal/nav/panel/tooltip aliases, unused glow/overlay fields, unused Mermaid CSS vars, and dead purple/font/shadow/motion/easing stops.
• Tighten ThemeService runtime dynamic exports with explicit family allowlists so custom theme extra fields cannot become uncontracted root CSS vars.
• Align FontPreference token generation with the reduced font-size contract and update theme governance docs/baselines.

Impact and Risk

• Internal shared web-ui code keeps canonical tokens; generated widget legacy compatibility remains isolated to iframe fallback mappings.
• Custom themes are normalized against the matching builtin light/dark base and validated before registration, while runtime injection now refuses to export retired extra fields such as --color-purple-300, --shadow-2xl, --motion-lazy, --easing-bounce, or --font-size-5xl.
• Installer and mobile-web still own separate product-shape token sets; this PR does not silently rewrite those independent surfaces.
• No ordinary app raw colors, unresolved CSS vars, generated widget undefined vars, fallback-only vars, or internal compatibility alias reads remain in the shared web-ui audit.

Metrics

Base data is from gcwing/main at 70f234135e18cc63c6fed1603d8193c15c82e0ae; after data is this PR head d87f8b8bc16b19c01a754b99981ffaf0e2256843, both measured with scripts/audit-theme-colors.mjs --json --no-baseline.

Metric	Before	After	Delta
CSS var definitions	988	946	-42
Contract-defined CSS vars	631	585	-46
Static contract CSS vars	601	574	-27
Runtime contract CSS vars	134	113	-21
Dynamic runtime families	15	13	-2
Total color occurrences	668	664	-4
Total unique colors	459	456	-3
Token colors	362 / 257 unique	360 / 255 unique	-2 / -2
Exception colors	306 / 246 unique	304 / 245 unique	-2 / -1
Theme preset colors	190 / 162 unique	189 / 161 unique	-1 / -1
Token contract colors	128 / 114 unique	127 / 113 unique	-1 / -1
Mermaid colors	93 / 74 unique	91 / 73 unique	-2 / -1
Generated widget payload vars	157	157	0
Generated widget undefined vars	0	0	0
Internal compatibility alias reads	0	0	0
Unresolved / fallback-only / required-missing vars	0 / 0 / 0	0 / 0 / 0	0

Review Notes

• Dynamic key risk was reviewed directly: ThemeService no longer exports open-ended Object.entries(...) families for accent, purple, effects, motion, or typography.
• Retired key searches show shared web-ui production code no longer consumes the removed root/runtime keys; remaining hits are limited to tests, docs/compatibility mappings, or independent mobile/installer surfaces.
• --radius-* and --spacing-* are retired from shared root/runtime contracts and internal reads; they remain recognized only as generated-widget iframe compatibility aliases mapped to --size-radius-* and --size-gap-*.

Validation

• git fetch gcwing main
• git merge-base --is-ancestor gcwing/main HEAD and git rev-list --left-right --count gcwing/main...HEAD -> 0 1
• pnpm run theme:color-audit -- --top 40
• node --test scripts/audit-theme-colors.test.mjs -> 26 passed
• pnpm --dir src/web-ui run test:run src/infrastructure/theme/core/ThemeService.test.ts src/infrastructure/font-preference/types/fontPreference.test.ts src/infrastructure/theme/presets/themePresetOutput.test.ts -> 3 files / 29 tests passed
• pnpm run generate-startup-theme-bootstrap -- --check
• pnpm run theme:visual-contract
• git diff --check gcwing/main..HEAD
• gh pr checks 1368 --repo GCWing/BitFun -> Frontend Build and Rust Build Check on macOS, Ubuntu, and Windows passed