fix: do not clear card color when update omits the field

[Lightshadow02]

• Resolves: Card update API clears the existing color when the color field is omitted #8131
• Target version: main

Summary

CardService::update() unconditionally called $card->setColor($color), so any API client that omits the color field on a card update (mobile clients, scripts, integrations) silently wiped the stored card color.

This applies the exact mechanism already used for the done field: the controllers build an OptionalNullableValue only when the request body actually contains a color key (array_key_exists), and the service only touches the color when the wrapper is present:

• field omitted → color kept (the fix)
• explicit null or "" → color cleared
• hex string → color set

The service guards with is_string(), so malformed non-scalar payloads (e.g. an array) are treated as "clear" instead of being string-cast. Note: an unquoted numeric JSON value ("color": 123456), which previously coerced to the string "123456", now also clears — strings are the documented type for this field.

The web frontend always sends the full card object including color, so UI behaviour is unchanged. Covered by four new PHPUnit cases (kept / cleared via null / cleared via empty string / set).

How to test

1. Set a card color in the web UI
2. PUT /index.php/apps/deck/cards/{cardId} with a body that contains title/stackId/type/order but no color key
3. Before: color wiped. After: color kept. Sending "color": null still clears it.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Documentation (manuals or wiki) has been updated or is not required

🤖 Generated with Claude Code

[Lightshadow02]

Just a note on the two red checks here: they look like the known-flaky Cypress e2e suite rather than a regression from this PR. The same workflow currently fails on main itself in its last four runs (2026-07-08, 07-09, 07-13, 07-15), each time on a different unrelated spec (boardFeatures.js — Exports a board as JSON, cardFeatures.js — Set a due date, …), none of which touch card colors. Everything else is green: the three PHPUnit matrices, psalm and the lint jobs.

The change itself is backend-only and covered by four unit tests (color kept when the field is omitted / cleared on explicit null / cleared on empty string / set from a hex value). Happy to rebase or re-run anything if that helps.

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)