phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report:

**Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)**

- Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired.
- No defects found; zero changes made — working tree left exactly as the task executors left it.
- Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation.
- Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings.
- Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules.
- Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted.
- Next pending phase: **none** — 91 is the last phase in `todo/`.

app/main.py

@@ -40,6 +40,7 @@ from app.api.steering import router as steering_router
 from app.api.suggestions import router as suggestions_router
 from app.api.sync import router as sync_router
 from app.api.tokens import router as tokens_router
+from app.api.ui_settings import router as ui_settings_router
 from app.config import get_settings
 from app.core.auth import ensure_admin_configured
 from app.core.caching import configure_caching
@@ -122,6 +123,10 @@ def create_app() -> FastAPI:
     # Phase 79: the admin token surface (create/list/revoke) — admin-only
     # (router-wide require_admin; a token USER stays 403 here, task 03).
     app.include_router(tokens_router, prefix="/api")
+    # Phase 91 (task 01): the admin UI-settings surface (GET/PUT the
+    # single ui_settings row — the Theme tab's persistence) — admin-only
+    # (router-wide require_admin; anonymous AND token users stay 403).
+    app.include_router(ui_settings_router, prefix="/api")
     # Phase 51: the anonymous shared-chat read — NO admin dependency.
     # /api/shared/<token> is the JSON snapshot; /shared/<token> (the
     # page route below, registered without a prefix) is the page.
@@ -156,6 +161,7 @@ def create_app() -> FastAPI:
                 "/git-sources.html",
                 "/history.html",
                 "/tokens.html",  # phase 79 task 06: the Tokens view
+                "/theme.html",  # phase 91 task 04: the Theme view (shell route)
             ),
         )
         app.mount("/", StaticFiles(directory=static_dir, html=True), name="static")