[mortondev]

The first of a stack that builds a new design engine for the portal. This one closes a CSS injection, adds audit rows for branding saves, and puts in place the tests the later PRs are measured against. Apart from the color-scheme fix, nothing a visitor sees changes.

Fixes

• CSS injection through branding colours. The settings page saved branding as an open record, and the generator wrote each value straight into a declaration, so a colour such as red; } body { display: none rewrote the portal's CSS. The save now refuses any value that could end its declaration, open or close a block, start a comment or at-rule, escape a character, close the style element or load a resource. It still accepts everything the editor has produced: named colours, var(), color-mix(), legacy tokens and retired presets. The generator treats an unsafe stored value as absent, so rows saved before this still load and the base palette fills the gap.
• Native controls followed the OS, not the page. * { color-scheme: light dark } overrode the scheme <html> carries, so scrollbars and form controls in a forced-dark portal, and in the admin, followed the visitor's OS. Elements now inherit the document's scheme. Three tokens and rules nothing reads are gone too: --elevated, --font-family-sans and the widget's html.system.

Audit

Saving the theme or the custom CSS from the settings page records branding.theme.changed or branding.css.changed, with the person, the request and the value before and after. A save that leaves the value as it was records nothing. The audit log page can filter on both.

Harness

• Style snapshots. bun run perf:style-snap boots the production build against the bench database and records every element's computed colour, border, radius, shadow, type and spacing on eight portal pages (feed, roadmap, changelog, an entry, a post, help center, an auth page and the widget), in light and dark. Comparing two snapshots lists every difference, so a theme or CSS change that should look the same can prove it.
• Golden contrast. contrastRatio() gives the WCAG 2.x ratio of the hex and oklch() values the theme writes. The golden test measures all 16 presets and 11 accents that have broken readability, in light and dark, on 13 pairs the portal paints. Today 120 pairs fall short, mostly field edges and link text on bright accents. They are recorded in contrast.golden.known.json, and the test holds the list in both directions, so it can only shrink.
• Design options and reference designs. lib/shared/design/options.ts lists every choice a portal design offers. Eight reference designs, four with a Home page, use every option and both sides of every switch between them. Adding an option fails the test until a design uses it.

Refactor

PortalDesignStyle writes the workspace theme and custom CSS for the portal, the widget, the portal auth pages and the access gate, which each wrote the same two style tags by hand.

Verification

• Typecheck, lint, the production build and the server-function manifest check pass.
• Unit suite: 22,031 passed. The one failure, an MCP auth test that timed out under full-suite load, passes on its own.
• Style snapshots: two runs of the same build compare with no differences, and the refactor changes nothing. The color-scheme fix changes only color-scheme, on every element below <html> (4,520 across the 16 pages), from light dark to the page's own scheme.
• Each new guard was broken on purpose to see its test fail: the injection check, the no-change audit rule, the contrast list, the option coverage and the Home block widths.

[mortondev]

Condensed into #878. The stack is now five PRs, #878 to #882; this branch is kept as it was.