feat: visual identity, theme toggle, custom CSS, loading states (M4)

Grounds the visual design in the product's own subject matter (vital-
signs monitoring) rather than generic dark-mode defaults: a signature
"pulse" green tied to healthy status (the accent color and the "up"
status color are the same hue - a steady green pulse reads as
healthy, same convention as a cardiac monitor), a small ECG-trace
brand mark, and a restrained pulsing-glow animation on healthy status
dots (prefers-reduced-motion respected) as the one deliberate motion
touch. Typography moves off the bare system-ui stack: IBM Plex Sans
for UI text, IBM Plex Mono with tabular numerals for metric values
(CPU/mem/uptime/latency), Space Grotesk used once for the wordmark -
chosen partly for IBM Plex's own systems-monitoring heritage.

Functional additions:
- Light/dark toggle, independent of config.yml's theme.mode, persisted
  to localStorage with a blocking inline script to avoid a flash of
  the wrong theme on load; auto mode now genuinely follows
  prefers-color-scheme instead of hardcoding dark.
- theme.customCssPath support via a new route handler that serves a
  user-mounted CSS file at runtime (can't be a build-time import,
  hence the targeted no-css-tags lint suppression), with a path-
  traversal guard since it's still reading from disk on every request.
- Loading-skeleton state for widgets awaiting their first WebSocket
  result, distinct from both the error state and genuine no-data.

Verified visually in Chrome: theme toggle switches instantly in both
directions, a live docker widget's status dot and monospace metrics
render correctly in both palettes, and config hot-reload still adds a
new widget without a page refresh.

components/widgets/docker/Widget.tsx

@@ -3,6 +3,7 @@
 import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { StatusDot } from "@/components/widgets/StatusDot";
+import { SkeletonLines } from "@/components/widgets/Skeleton";
 import { formatBytes, formatUptime } from "@/lib/format";
 
 type DockerWidget = Extract<Widget, { type: "docker" }>;
@@ -30,17 +31,33 @@ export function DockerWidget({ widget, widgetId }: { widget: DockerWidget; widge
         <StatusDot status={data?.status} health={data?.health} />
       </div>
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
+      {!result && !errorMessage && <SkeletonLines />}
       {data && (
         <dl className="flex flex-col gap-1 text-xs text-fg-muted">
-          {data.uptimeSeconds !== null && <div>Uptime: {formatUptime(data.uptimeSeconds)}</div>}
-          {widget.showStats && data.cpuPercent !== null && <div>CPU: {data.cpuPercent.toFixed(1)}%</div>}
-          {widget.showStats && data.memUsageBytes !== null && (
+          {data.uptimeSeconds !== null && (
             <div>
-              Mem: {formatBytes(data.memUsageBytes)}
-              {data.memLimitBytes ? ` / ${formatBytes(data.memLimitBytes)}` : ""}
+              Uptime: <span className="font-mono tabular-nums text-fg">{formatUptime(data.uptimeSeconds)}</span>
+            </div>
+          )}
+          {widget.showStats && data.cpuPercent !== null && (
+            <div>
+              CPU: <span className="font-mono tabular-nums text-fg">{data.cpuPercent.toFixed(1)}%</span>
+            </div>
+          )}
+          {widget.showStats && data.memUsageBytes !== null && (
+            <div>
+              Mem:{" "}
+              <span className="font-mono tabular-nums text-fg">
+                {formatBytes(data.memUsageBytes)}
+                {data.memLimitBytes ? ` / ${formatBytes(data.memLimitBytes)}` : ""}
+              </span>
+            </div>
+          )}
+          {data.restartCount > 0 && (
+            <div>
+              Restarts: <span className="font-mono tabular-nums text-fg">{data.restartCount}</span>
             </div>
           )}
-          {data.restartCount > 0 && <div>Restarts: {data.restartCount}</div>}
         </dl>
       )}
     </div>