feat(rhema-code): add the colors setting with four palettes

The stored `colors` key names a palette — rhema (the default,
Jadeite), aquamarine, black-and-white, or dracula — and the
Appearance page of /settings cycles it live, like the theme and
icon toggles beside it. Each palette carries a dark and a light
appearance under the existing `theme` key; dracula's light side is
derived, the official palette ships only dark.

The appearance decision moves off token comparison: Theme now
answers is_dark() from the ground/text luminance, so palettes
beyond the original two get the right per-profile fallback tones.

deploy/docker/ui.Dockerfile

@@ -0,0 +1,40 @@
+# rhema-claw-ui: the web UI's static bundle behind nginx.
+# Build from the repo root (the context is the repo):
+#   docker build -f deploy/docker/ui.Dockerfile -t rhema-claw-ui .
+
+# The build: the Nuxt app generates a fully static bundle (ssr is off —
+# the UI is a client of the claw's API, nothing server-side to run).
+FROM node:22-alpine AS build
+WORKDIR /web
+COPY web/claw/package.json web/claw/package-lock.json ./
+# The lock file pins the tree; ci is the reproducible install.
+RUN npm ci
+COPY web/claw ./
+RUN npm run build
+
+# The runtime: nginx serves the bundle with an SPA fallback — the app is
+# one page, but a browser hitting a stale deep link must land on it, not
+# on a 404. Index is served no-cache (a new deploy must not be masked by
+# the browser), the hashed _nuxt assets are forever-cacheable.
+FROM nginx:alpine
+COPY <<'NGINX' /etc/nginx/conf.d/default.conf
+server {
+    listen 80;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location /_nuxt/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        try_files $uri =404;
+    }
+    location / {
+        add_header Cache-Control "no-cache";
+        try_files $uri $uri/ /index.html;
+    }
+}
+NGINX
+COPY --from=build /web/.output/public /usr/share/nginx/html
+
+# The UI is stateless static files: any number of replicas, no PVC, and
+# the claw's single-node invariant does not apply here.
+EXPOSE 80