v2.3.0 — light and dark appearance for both portals

Both the customer portal and operator cockpit now support System / Light / Dark appearance across all six brand palettes.

• System follows OS appearance; a saved browser choice applies before first paint and synchronizes across same-origin tabs.
• Light palettes, semantic alert surfaces, paired chat/button colors, and native form controls update together. Dynamically inserted HTMX/SSE content inherits the selected appearance.
• The appearance control is accessible in desktop and mobile navigation. Branding previews show both portal modes.
• BSS_PORTAL_APPEARANCE=system|light|dark sets the deployment default; explicit browser choices take precedence.

Existing branding IDs and dark email/CLI palettes remain unchanged. No database migration is required. Browser preferences are stored per origin, so separate portal hostnames/ports retain independent choices.

Validation: 552 Rust tests passed (48 existing live/opt-in tests ignored), formatting/clippy/doctrine checks passed, preference regressions and all 12 app/palette browser combinations (including danger-action contrast) passed, and actual customer/cockpit pages passed phone/tablet/desktop rendering checks. The full isolated hero suite passed three consecutive times: 19/19 scenarios per run (57 executions), including LLM/operator/customer flows and telemetry. GitHub CI passed on the final feature commit.

The troubleshooting hero prompt now explicitly requests the customer-scoped subscription lookup before selecting a top-up; its existing tool and state assertions are unchanged.