feat(rhema-code): add the colors setting with four palettes

The stored `colors` key names a palette — rhema (the default,
Jadeite), aquamarine, black-and-white, or dracula — and the
Appearance page of /settings cycles it live, like the theme and
icon toggles beside it. Each palette carries a dark and a light
appearance under the existing `theme` key; dracula's light side is
derived, the official palette ships only dark.

The appearance decision moves off token comparison: Theme now
answers is_dark() from the ground/text luminance, so palettes
beyond the original two get the right per-profile fallback tones.

.gitea/workflows/android.yml

@@ -0,0 +1,112 @@
+name: android
+
+# The phone client's pipeline, separate from the rust/chart/docker/web
+# gates: it needs its own toolchain (JDK + the Android SDK), and the
+# release job is the only CI job holding a secret. Both artifacts feed
+# the update story: the debug one must install over any local build
+# (committed debug key), the release one anchors the future edge
+# channel (secret key, never in the source).
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  debug:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Set up JDK 21
+        run: |
+          sudo apt-get update && sudo apt-get install -y openjdk-21-jdk-headless
+          echo "JAVA_HOME=$(dirname "$(dirname "$(readlink -f "$(which java)")")")" >> "$GITHUB_ENV"
+
+      - name: Set up the Android SDK
+        run: |
+          sudo apt-get update && sudo apt-get install -y wget unzip
+          mkdir -p "$HOME/android-sdk/cmdline-tools"
+          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
+            -O /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d "$HOME/android-sdk/cmdline-tools"
+          mv "$HOME/android-sdk/cmdline-tools/cmdline-tools" \
+            "$HOME/android-sdk/cmdline-tools/latest"
+          yes | "$HOME/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null || true
+          echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
+
+      - name: Build and lint
+        run: |
+          cd android
+          ./gradlew :app:assembleDebug :app:lintDebug
+
+      # The artifact must install over any previous debug build, so the
+      # identity is part of the contract: pin the committed keystore's
+      # certificate, not merely "some debug key".
+      - name: Verify the APK signature
+        run: |
+          APKSIGNER=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort | tail -1)
+          "$APKSIGNER" verify --print-certs android/app/build/outputs/apk/debug/app-debug.apk \
+            | grep -q 13e65a1e4fb828318077784c029e8f2664dba5ef8feece01b950b6bc2b015b64
+
+      - name: Upload the debug APK
+        uses: https://gitea.com/actions/gitea-upload-artifact@v4
+        with:
+          name: rhema-android-debug
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
+          retention-days: 14
+
+  release:
+    # The signed release artifact is the future edge channel's payload,
+    # so it only exists where the secrets exist: Gitea withholds
+    # secrets from fork pull_request runs, and an unsigned artifact
+    # would be a build check, not a deliverable.
+    if: gitea.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Set up JDK 21
+        run: |
+          sudo apt-get update && sudo apt-get install -y openjdk-21-jdk-headless
+          echo "JAVA_HOME=$(dirname "$(dirname "$(readlink -f "$(which java)")")")" >> "$GITHUB_ENV"
+
+      - name: Set up the Android SDK
+        run: |
+          sudo apt-get update && sudo apt-get install -y wget unzip
+          mkdir -p "$HOME/android-sdk/cmdline-tools"
+          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
+            -O /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d "$HOME/android-sdk/cmdline-tools"
+          mv "$HOME/android-sdk/cmdline-tools/cmdline-tools" \
+            "$HOME/android-sdk/cmdline-tools/latest"
+          yes | "$HOME/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null || true
+          echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
+
+      - name: Decode the release keystore
+        run: |
+          echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" | base64 -d > /tmp/release.keystore
+
+      - name: Build
+        run: |
+          cd android
+          ./gradlew :app:assembleRelease
+        env:
+          ANDROID_RELEASE_KEYSTORE: /tmp/release.keystore
+          ANDROID_RELEASE_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_RELEASE_KEYSTORE_PASSWORD }}
+
+      # Same contract as the debug artifact, tighter stakes: this key
+      # can update any install that trusts the channel.
+      - name: Verify the APK signature
+        run: |
+          APKSIGNER=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort | tail -1)
+          "$APKSIGNER" verify --print-certs android/app/build/outputs/apk/release/app-release.apk \
+            | grep -q 8bd94fd4c2fe69557ccde6dd2e5c786c5288420674044ffe2c3fc2c55eb8f4f7
+
+      - name: Upload the release APK
+        uses: https://gitea.com/actions/gitea-upload-artifact@v4
+        with:
+          name: rhema-android-release
+          path: android/app/build/outputs/apk/release/app-release.apk
+          if-no-files-found: error
+          retention-days: 14