feat: visual identity, theme toggle, custom CSS, loading states (M4)

Grounds the visual design in the product's own subject matter (vital-
signs monitoring) rather than generic dark-mode defaults: a signature
"pulse" green tied to healthy status (the accent color and the "up"
status color are the same hue - a steady green pulse reads as
healthy, same convention as a cardiac monitor), a small ECG-trace
brand mark, and a restrained pulsing-glow animation on healthy status
dots (prefers-reduced-motion respected) as the one deliberate motion
touch. Typography moves off the bare system-ui stack: IBM Plex Sans
for UI text, IBM Plex Mono with tabular numerals for metric values
(CPU/mem/uptime/latency), Space Grotesk used once for the wordmark -
chosen partly for IBM Plex's own systems-monitoring heritage.

Functional additions:
- Light/dark toggle, independent of config.yml's theme.mode, persisted
  to localStorage with a blocking inline script to avoid a flash of
  the wrong theme on load; auto mode now genuinely follows
  prefers-color-scheme instead of hardcoding dark.
- theme.customCssPath support via a new route handler that serves a
  user-mounted CSS file at runtime (can't be a build-time import,
  hence the targeted no-css-tags lint suppression), with a path-
  traversal guard since it's still reading from disk on every request.
- Loading-skeleton state for widgets awaiting their first WebSocket
  result, distinct from both the error state and genuine no-data.

Verified visually in Chrome: theme toggle switches instantly in both
directions, a live docker widget's status dot and monospace metrics
render correctly in both palettes, and config hot-reload still adds a
new widget without a page refresh.

app/api/theme/custom-css/route.ts

@@ -0,0 +1,34 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { configStore } from "@/lib/config/loader";
+
+export const dynamic = "force-dynamic";
+
+const CONFIG_DIR = path.join(process.cwd(), "config");
+
+export async function GET(): Promise<Response> {
+  let customCssPath: string | undefined;
+  try {
+    customCssPath = configStore.get().theme.customCssPath;
+  } catch {
+    return new Response("", { status: 204 });
+  }
+
+  if (!customCssPath) {
+    return new Response("", { status: 204 });
+  }
+
+  const resolved = path.normalize(path.join(CONFIG_DIR, customCssPath));
+  if (!resolved.startsWith(CONFIG_DIR + path.sep)) {
+    return new Response("", { status: 204 });
+  }
+
+  try {
+    const css = await readFile(resolved, "utf-8");
+    return new Response(css, {
+      headers: { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" },
+    });
+  } catch {
+    return new Response("", { status: 204 });
+  }
+}