refactor(theme): tighten extension color governance

[limityan]

Summary

• remove unused legacy SCSS color/mixin aliases from the central token layer and lower the color-governance baseline accordingly
• add a near-color decision registry across web-ui, mobile-web, and installer roots so specialized near pairs require explicit root/owner/reason/reevaluation criteria
• harden theme extension boundaries: 7-key plugin projection, OpenCode-compatible CLI presets, one-hop generated-widget aliases, and custom theme projection coverage
• replace the remaining component-library Tabs legacy mixin call with explicit existing token-based styles, preserving the previous lightweight active-card shadow level

Impact

• web-ui production color literals drop from 538 occurrences / 346 unique colors to 536 occurrences / 345 unique colors
• token-contract scope drops from 110 occurrences / 98 unique colors to 108 occurrences / 97 unique colors
• installer near-color pairs are no longer an untracked exception; all remaining installer pairs have explicit owner and product/design rationale
• no app UI raw colors, fallback colors, unresolved CSS vars, non-contract cross-file vars, or dynamic-family unexported vars are introduced

Risk review

• No intended visual behavior change. Removed Sass mixins and aliases no longer have exact consumers; README examples now point to the canonical token.
• Subagent review found the active Tabs card shadow could become heavier than the old mixin; this PR now uses the existing overlay token to keep the old lightweight shadow behavior.
• Near-color pairs that remain are documented as adjacent state ramps or theme-identity surfaces instead of silently treated as debt.
• Generated widget payload compatibility remains separate from the plugin theme API; the plugin boundary stays capped at 7 OpenCode-style color keys.

Verification

• node --test scripts/audit-theme-colors.test.mjs scripts/audit-cli-theme-colors.test.mjs
• pnpm run theme:color-audit:all
• pnpm --dir src/web-ui run test:run src/tools/generative-widget/themePayload.test.ts src/infrastructure/theme/core/ThemeService.test.ts src/infrastructure/theme/presets/themePresetOutput.test.ts
• pnpm run theme:visual-contract
• pnpm run type-check:web
• pnpm run lint:web
• pnpm --dir src/web-ui build
• pnpm run verify:monaco-assets
• git diff --check