feat(web): customizable placeholder, footer text, and color theme via BOR_* env vars

BOR_INPUT_PLACEHOLDER / BOR_FOOTER_TEXT / BOR_THEME (+ the indigo.css example theme); authoring guide: frontend/assets/themes/README.md, docs: README 'Customizing the look'.

tests/e2e/test_configurable_brand.py

@@ -146,16 +146,28 @@ def test_api_config_serves_both_names(testy_server: str, app_server: str) -> Non
     body = r.json()
     # Phase 59 (task 05): the third key is the docs-push flag — the
     # "Save as doc" gating; both instances run with BOR_DOCS_REPO
-    # empty, so it is the inert false here.
-    assert set(body) == {"app_name", "version", "docs_repo_configured"}
+    # empty, so it is the inert false here. Phase 62 (task 01): the
+    # endpoint grew to six keys — this suite's instances carry no
+    # UI-customization overrides, so the three new keys are their
+    # defaults.
+    assert set(body) == {
+        "app_name", "version", "docs_repo_configured",
+        "input_placeholder", "footer_text", "theme",
+    }
     assert body["app_name"] == TESTY_NAME
     assert body["docs_repo_configured"] is False
 
     # The shared conftest instance keeps the default (the other
-    # suites' title/label contract rides on it).
+    # suites' title/label contract rides on it) — and its key set
+    # grew with the endpoint (phase 62).
     r2 = httpx.get(f"{app_server}/api/config", timeout=5)
     assert r2.status_code == 200
-    assert r2.json()["app_name"] == DEFAULT_NAME
+    r2_body = r2.json()
+    assert set(r2_body) == {
+        "app_name", "version", "docs_repo_configured",
+        "input_placeholder", "footer_text", "theme",
+    }
+    assert r2_body["app_name"] == DEFAULT_NAME
 
 
 # ---------------------------------------------------------------------------