feat(themes): free-form community themes with a security floor (#1015)

* feat(themes): free-form community themes with a security floor

Community themes are no longer token-only. The in-app guard
(validateThemeCss) now enforces only a security floor — no network
(@import / non-data url()), no scripts (<style>/<script>/expression()/
javascript:/-moz-binding), no @property, @keyframes namespaced as <id>-,
and a 256 KB cap — and otherwise allows any selectors, structure and
animations. validateThemePackage checks the manifest plus that floor.

Themes can react to app state via same-element attributes set on the theme
root: data-playing, data-fullscreen, data-sidebar-collapsed, data-lyrics-open.

The local-import confirm dialog now notes that imported themes aren't
reviewed and are installed at the user's own risk. Removes the now-unused
bundled token whitelist.

* docs(themes): note free-form themes in the Theme Store entry

Add PR #1015 and a free-form bullet to the still-unreleased Theme Store
changelog and credits entry.

src/locales/de/settings.ts

@@ -365,6 +365,7 @@ export const settings = {
   themeImportErrorDetails: 'Technische Details',
   themeImportConfirmTitle: 'Theme installieren?',
   themeImportConfirmBody: '„{{name}}“ von {{author}} installieren?',
+  themeImportConfirmRisk: 'Importierte Themes werden nicht geprüft — installiere nur Themes, denen du vertraust.',
   tabLibrary: 'Bibliothek',
   tabServers: 'Server',
   tabLyrics: 'Songtexte',

src/locales/en/settings.ts

@@ -432,6 +432,7 @@ export const settings = {
   themeImportErrorDetails: 'Technical details',
   themeImportConfirmTitle: 'Install theme?',
   themeImportConfirmBody: 'Install "{{name}}" by {{author}}?',
+  themeImportConfirmRisk: "Imported themes aren't reviewed — only install themes you trust.",
   tabLibrary: 'Library',
   tabServers: 'Servers',
   tabLyrics: 'Lyrics',

src/locales/es/settings.ts

@@ -363,6 +363,7 @@ export const settings = {
   themeImportErrorDetails: 'Detalles técnicos',
   themeImportConfirmTitle: '¿Instalar tema?',
   themeImportConfirmBody: '¿Instalar «{{name}}» de {{author}}?',
+  themeImportConfirmRisk: 'Los temas importados no se revisan: instala solo temas en los que confíes.',
   tabLibrary: 'Biblioteca',
   tabServers: 'Servidores',
   tabLyrics: 'Letras',

src/locales/fr/settings.ts

@@ -361,6 +361,7 @@ export const settings = {
   themeImportErrorDetails: 'Détails techniques',
   themeImportConfirmTitle: 'Installer le thème ?',
   themeImportConfirmBody: 'Installer « {{name}} » de {{author}} ?',
+  themeImportConfirmRisk: "Les thèmes importés ne sont pas vérifiés — n'installez que des thèmes de confiance.",
   tabLibrary: 'Bibliothèque',
   tabServers: 'Serveurs',
   tabLyrics: 'Paroles',

src/locales/nb/settings.ts

@@ -364,6 +364,7 @@ export const settings = {
   themeImportErrorDetails: 'Tekniske detaljer',
   themeImportConfirmTitle: 'Installere tema?',
   themeImportConfirmBody: 'Installere «{{name}}» av {{author}}?',
+  themeImportConfirmRisk: 'Importerte temaer blir ikke gjennomgått — installer bare temaer du stoler på.',
   tabStorage: 'Frakoblet & Cache',
   inputKeybindingsTitle: 'Tastatursnarveier',
   aboutContributorsCount_one: '{{count}} bidrag',

src/locales/nl/settings.ts

@@ -361,6 +361,7 @@ export const settings = {
   themeImportErrorDetails: 'Technische details',
   themeImportConfirmTitle: 'Thema installeren?',
   themeImportConfirmBody: '"{{name}}" van {{author}} installeren?',
+  themeImportConfirmRisk: 'Geïmporteerde thema’s worden niet gecontroleerd — installeer alleen thema’s die je vertrouwt.',
   tabLibrary: 'Bibliotheek',
   tabServers: 'Servers',
   tabLyrics: 'Songteksten',

src/locales/ro/settings.ts

@@ -367,6 +367,7 @@ export const settings = {
   themeImportErrorDetails: 'Detalii tehnice',
   themeImportConfirmTitle: 'Instalezi tema?',
   themeImportConfirmBody: 'Instalezi „{{name}}” de {{author}}?',
+  themeImportConfirmRisk: 'Temele importate nu sunt verificate — instalează doar teme în care ai încredere.',
   tabLibrary: 'Librărie',
   tabServers: 'Servere',
   tabLyrics: 'Versuri',

src/locales/ru/settings.ts

@@ -443,6 +443,7 @@ export const settings = {
   themeImportErrorDetails: 'Технические подробности',
   themeImportConfirmTitle: 'Установить тему?',
   themeImportConfirmBody: 'Установить «{{name}}» от {{author}}?',
+  themeImportConfirmRisk: 'Импортированные темы не проверяются — устанавливайте только темы, которым доверяете.',
   tabLibrary: 'Библиотека',
   tabServers: 'Серверы',
   tabLyrics: 'Тексты песен',

src/locales/zh/settings.ts

@@ -360,6 +360,7 @@ export const settings = {
   themeImportErrorDetails: '技术细节',
   themeImportConfirmTitle: '安装主题？',
   themeImportConfirmBody: '安装来自 {{author}} 的“{{name}}”？',
+  themeImportConfirmRisk: '导入的主题未经审核——请仅安装你信任的主题。',
   tabLibrary: '媒体库',
   tabServers: '服务器',
   tabLyrics: '歌词',