Light theme visual pass

[ApocDev]

The theme tokens (including the semantic success/warning/info/surplus hues added in #17) all have light-mode values, but the app has only ever been visually verified in dark mode — html is pinned color-scheme: dark and nothing toggles the .dark class.

Either do a proper light-mode pass (screenshot every route with the light palette, fix contrast/tint issues, add a theme toggle in Settings) or decide dark-only is the product and remove the light token set so it can't silently rot. Parked for later by choice.

[ApocDev]

Mechanism shipped (3c00b92): a light/dark/system toggle in Settings → Display, persisted at pyops.theme, applied by lib/theme.ts (toggles .dark + color-scheme, follows the OS while on system), with a pre-paint script in the root document so switching never flashes. Audited the whole codebase for raw-palette leaks — zero (the design-system guard has held), so every surface inherits the light token set. Verified by a unit test (persist/apply/system-resolve) and an e2e (the class + color-scheme flip and survive a reload).

Left open on purpose for the visual pass: light mode is now reachable and wired, but 'does every route read well in light' — contrast, tint balance across the new surfaces (recipe/dependency explorers, the sankey view, IIS cards, the pin editor) — is an inherently visual judgment I can't certify without eyeballing screenshots. Flip it on and nitpick; that's the remaining half. (This also settles the issue's fork: the light tokens aren't dead code to remove — they're live.)