feat(web): customizable placeholder, footer text, and color theme via BOR_* env vars

BOR_INPUT_PLACEHOLDER / BOR_FOOTER_TEXT / BOR_THEME (+ the indigo.css example theme); authoring guide: frontend/assets/themes/README.md, docs: README 'Customizing the look'.

app/config.py

@@ -46,6 +46,15 @@ class Settings(BaseSettings):
     log_level: str = "INFO"
     static_dir: str = "frontend"
 
+    # --- UI customization (phase 62, TODO L3) ---
+    # Defaults are the phase-61 neutral copy — UNSET => byte-identical UI.
+    input_placeholder: str = "Ask me anything…"
+    footer_text: str = "Powered by self-hosted models"
+    #: Theme file NAME under frontend/assets/themes/ (e.g. "indigo.css");
+    #: empty = the built-in dark-tech palette. Validated: bare filename
+    #: only — no paths, no ".." (no-CDN: served from the static dir).
+    theme: str = ""
+
     # --- Database (PostgreSQL 17 + pgvector) ---
     database_url: str = "postgresql+psycopg://reese:reese@localhost:5432/brain_of_reese"
 
@@ -202,6 +211,27 @@ class Settings(BaseSettings):
     #: separate from ``sources_dir`` (the source checkouts).
     docs_work_dir: str = "~/bor-docs"
 
+    @field_validator("theme", mode="after")
+    @classmethod
+    def _theme_bare_css_filename(cls, v: str) -> str:
+        r"""Phase 62 (A5): the theme is a FILE NAME under
+        ``frontend/assets/themes/``, served from the static dir
+        (no-CDN) — so only a bare lowercase ``.css`` filename is legal
+        (``^[a-z0-9_-]+\.css$``). Anything else (a path, ``..``,
+        uppercase, a missing extension) is a typo that would silently
+        404 at runtime — fail loudly at startup instead, naming the
+        offending value and the allowed shape (the phase-56 fail-loud
+        house style)."""
+        if v == "":
+            return v  # empty = the built-in dark-tech palette
+        if re.fullmatch(r"[a-z0-9_-]+\.css", v) is None:
+            raise ValueError(
+                "theme must be a bare .css filename under "
+                "frontend/assets/themes/ (lowercase letters/digits/"
+                f"'_'/'-', e.g. 'indigo.css') — got {v!r}"
+            )
+        return v
+
     @field_validator("import_extensions")
     @classmethod
     def _import_extensions_known(cls, v: str) -> str: