chore(bricks): remove dead constructor hook + document sanitizer contract

integrations/bricks/includes/class-rest-controller.php

@@ -42,15 +42,17 @@ class Slashed_Bricks_REST_Controller {
 	const NAMESPACE = 'slashed-bricks/v1';
 
 	/**
-	 * Constructor — registers the REST routes on rest_api_init.
+	 * Constructor — intentionally empty.
 	 *
-	 * Now stateless: previous revisions held a reference to
-	 * `Slashed_Bricks_Admin_Page` to share its private sanitizer; that
-	 * dependency is gone now that sanitization lives in the dedicated
-	 * `Slashed_Bricks_Token_Sanitizer` class.
+	 * Route registration is handled by the caller
+	 * (slashed_bricks_rest_routes_init in slashed-bricks.php) which
+	 * invokes register_routes() directly inside a rest_api_init hook.
+	 * This keeps the class stateless and avoids redundant add_action()
+	 * calls that would fire too late when the controller is instantiated
+	 * during the already-running rest_api_init action.
 	 */
 	public function __construct() {
-		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
+		// No-op. Routes are registered externally via rest_api_init hook.
 	}
 
 	/**

integrations/bricks/includes/class-token-sanitizer.php

@@ -123,6 +123,15 @@ public static function is_hex_color( $value ) {
 	 * filter-set values). All-empty rows are omitted from the result
 	 * so the framework default applies.
 	 *
+	 * COMPOUND-PREFIX KEYS (dark mode):
+	 * Keys like `brand_dark_primary` enter the "direct" bucket because
+	 * they don't end in `_hex` or `_raw`. The Svelte ColorRow merges
+	 * hex/raw client-side and submits the resolved value under the bare
+	 * compound key. This is intentional: dark-mode overrides are never
+	 * submitted as paired `_hex`/`_raw` inputs. Do NOT add color names
+	 * that end in "hex" or "raw" — they would collide with suffix
+	 * stripping.
+	 *
 	 * @param array $data Raw form data for the colors section.
 	 * @return array Sanitized colors keyed by base token name.
 	 */