Add database-backed UI whitelabeling

[deltawi]

What

• add an admin-only Theme tab for the instance name, simple/expanded logos, favicon, menu hover colour, and primary/secondary button colours
• apply runtime semantic brand tokens throughout the UI while preserving the existing DeltaLLM defaults
• store uploaded branding assets as PostgreSQL BYTEA values with content-addressed URLs, validation, ETags, and bounded in-memory replica caches
• update assets and their dynamic-config references atomically, then synchronize replicas through the existing Redis notification path with PostgreSQL polling as recovery
• add the Prisma migration, backend/UI contracts, audit actions, documentation, and regression coverage
• lazy-load the Settings route so the feature does not grow the initial UI bundle

Why

Platform administrators need a low-friction way to whitelabel a deployment without editing configuration files, mounting logo paths into every replica, or accepting replica-local asset latency and consistency problems.

Runtime and operational impact

• PostgreSQL is the durable source of truth for both the theme configuration and the three optional asset BLOBs.
• Redis pub/sub is only the fast invalidation signal; normal config reconciliation recovers missed events.
• Each API replica keeps at most the three validated assets in memory (2 MiB maximum per asset) and can reconstruct the cache from PostgreSQL.
• Theme mutations are platform-admin-only. Asset reads are public, immutable when content-addressed, and protected with strict MIME validation, CSP, nosniff, and conditional requests.
• This is control-plane functionality and adds no work to inference paths.
• Existing installations keep the current DeltaLLM name, logos, and colours until an administrator saves overrides.

Verification

• uv run ruff check <touched Python paths> — passed
• uv run ruff format --check <touched Python paths> — passed
• focused backend suite — 81 passed
• full backend suite — 2,767 passed, 122 skipped; the affected branding suite was rerun after the final header adjustment and UI-only route split
• uv run prisma generate --schema=./prisma/schema.prisma — passed
• npm ci --ignore-scripts — completed successfully
• npm run test:unit — 125 passed
• npm run build — passed
• full UI lint parity — branch and origin/main both report the same 276 errors and 11 warnings; no new findings
• initial JS bundle — 419.60 kB gzip on this branch versus 419.67 kB on origin/main; Settings is an 8.10 kB lazy chunk
• git diff --check origin/main...HEAD — passed
• Docker HA smoke — migration applied, upload/delete exercised, and two API replicas served identical content hashes immediately after synchronization

Notes

• npm ci reports a Node engine warning and 15 dependency audit advisories in the resulting dependency tree; this change does not attempt a dependency-wide audit remediation.