Rebuild the profile page on Pico CSS, and make user styling checkable

The first UI was a bespoke stylesheet: custom type, hand-drawn leaders,
colour used as meaning. It is removed. The page is now semantic HTML
styled by Pico CSS 2.1.1, set in Open Sans at 400 and 700, both vendored
under web/vendor/ so the page makes no third-party request.

The reason is not taste. profiles.custom_css was reserved for user
styling from the start, and user styling is only safe if "is this valid?"
has a mechanical answer. Against a bespoke stylesheet it does not — the
answer depends on which class the author happened to name and what it
happened to do. Against Pico it does: the whole page is drawn from
--pico-* variables, so a theme can be a list of assignments to named
variables with a declared grammar per property.

That is what theme.rs is. Every property is checked against a whitelist
of variables the vendored Pico actually defines, and every value against
a grammar, once, on write. Two properties fall out of the design rather
than being bolted onto it:

  - A theme has no selectors. It cannot position, hide or overlay
    anything, and cannot make one profile impersonate another part of the
    site. It recolours and re-spaces the template; that is all it can do.

  - Every accepted value is drawn from [0-9a-z#%.,/()+- ], so it cannot
    carry <, " or }. The rendered rule is safe to inline in a <style>
    element by construction, not by remembering to escape it.

The theme block is the last stylesheet in the document, so it wins ties
on document order — no user declaration ever has to out-specify Pico,
which a selector-based design would have forced.

Refusals name the offending declaration:

  --pico-primary: wine;      expected a colour, e.g. `#7b3fe4`, …
  --pico-primary-color: red; not a theme property — did you mean
                             `--pico-primary`?
  body { color: red }        `{` is not allowed: a theme is a list of
                             `--pico-…: value;` declarations
  --pico-font-family: …      not a theme property; the typeface is fixed

Open Sans is a variable font here, declared twice at 400 and 700 rather
than as a range, so Pico's occasional request for 600 resolves to 700
instead of rendering an in-between instance. Two weights, by construction.

GET /api/theme/properties serves the list from the binary that enforces
it, so the website, `devsite theme properties` and the docs cannot drift
from what is accepted. Editing is either the Appearance panel on your own
profile or `devsite theme set|show|clear`.

Two bugs found by driving a real browser rather than by reading the code:

  - An iframe parsed with the `hidden` attribute never renders a srcdoc
    assigned later, and no reassignment recovers it. The viewer now builds
    its iframe per open, which also destroys the previous service's
    document instead of blanking it.

  - Pico styles `ul li` directly, and a directly-matching rule beats an
    inherited one however specific, so `list-style` has to be set on the
    items rather than the list.

68 tests. The new ones are adversarial in the same spirit as
tests/authz.rs: a theme that tries to become a stylesheet, escape its own
rule, or name a property outside the whitelist.

See docs/profile-template.md for the template, the whitelist and the
grammars.

commit

6a8ca6bd7104fc41c58fa5e995e424cd66d79313

parent

4801ca95df7fca90181cca1b120b3b7c1f6c1fc7

author

Dami <dami.etoile@gmail.com>