feat: add validated appearance palettes

docs/UI_UX_DECISION_LEDGER.md

@@ -165,13 +165,17 @@ Decision: the WebUI shell exposes a small, stable appearance contract based on
 shared CSS tokens and persisted user preference selection.
 
 - Core applies `system`, `light`, and `dark` preferences at the document root.
+- Core applies validated user accent presets through `data-palette`; palette
+  values change semantic tokens globally and never require module CSS changes.
 - Core owns shared tokens such as `--bg`, `--bar`, `--panel`, `--surface`,
   `--line`, `--line-dark`, `--text`, `--text-strong`, `--muted`, semantic
   status colors, radii, shadows, and disabled-control colors.
 - Modules must style new UI with these tokens and shared controls. Module-local
   CSS may tune layout and spacing, but it must not introduce a separate
   appearance system.
-- Appearance controls live in user settings first. Tenant defaults and policy
+- Appearance controls live in user settings first. The user preference wins
+  over future tenant and system defaults unless a separately documented policy
+  lock is introduced. Tenant defaults and policy
   enforcement can be added later without changing the token contract.
 - Visual preview in settings is illustrative; it must reflect token families,
   not become a second theme implementation.