feat: palette and light/dark from go-bananas, and fix the image user

The theme selector and the appearance toggle are the custom elements
go-bananas ships, loaded at run time. They are custom elements rather than
components written here because the applications this service feeds are a mix of
React, vanilla JavaScript and server-rendered HTML, and a custom element is the
one shape all three can use with no build step, no import map, and no second copy
of React to break the hooks.

Every token in the stylesheet is now written as var(--bn-*, fallback). That
ordering is the safety property: with no theme service configured the page renders
exactly as it did before, and with one configured the same rules follow the
palette. The navigation rail takes the contract's sunken surface and its paired
foreground rather than a fixed dark navy, because a light appearance wants dark
text there.

THEME_BASE_URL is read from runtime-config.js, which the entrypoint rewrites from
the environment on start, so one image serves every environment rather than
baking a hostname into the bundle at build time.

contract.test.ts fetches the live contract and asserts it defines every --bn-*
variable this application consumes. A token renamed on the service would
otherwise leave every var() resolving to its fallback, and the page would look
correct while never actually following the palette. Verified it fails on a
deliberately wrong token name.

The image also had two USER lines, the second silently replacing the first with a
uid that owns neither /app nor /tmp/nginx. nginx could not create its pid file or
its temp paths, so the container failed to start. Confirmed by building both
variants: the old one cannot write nginx's temp directory, the fixed one serves
the front end, its hashed assets, and the /api proxy.

deploy/helm/go-guess/templates/api-deployment.yaml

@@ -46,6 +46,13 @@ spec:
               value: {{ .Values.api.environment | quote }}
             - name: FRONTEND_URL
               value: {{ include "go-guess.frontendURL" . | quote }}
+            {{- with .Values.api.themeBaseUrl }}
+            # The theme service is read by the browser, not the API, so it is passed
+            # through to the entrypoint, which writes the runtime config the page
+            # reads. Empty means this deployment keeps its own styling.
+            - name: THEME_BASE_URL
+              value: {{ . | quote }}
+            {{- end }}
             - name: TOKEN_TTL
               value: {{ .Values.api.tokenTTL | quote }}
             - name: MAX_UPLOAD_MB

deploy/helm/go-guess/values.yaml

@@ -32,6 +32,12 @@ api:
   # Public base URL used when building invitation and meeting links. Defaults to
   # https://<first tenant>.<domain> when empty.
   frontendURL: ""
+  # Origin of the go-bananas runtime supplying the shared styling contract, for
+  # example https://themes.urpi.be. Empty keeps this application's own styles, so
+  # a deployment without a theme service is unaffected. The service must also be
+  # configured to allow this application's origin, or the browser will refuse to
+  # load the controls from it.
+  themeBaseUrl: ""
   tokenTTL: 8h
   maxUploadMB: 10
   service: