feat: Y2K dither theme, filter toolbars, chat bubble widget; fix alignment root causes

- theme rework (user request): white paper bg, brown ink, ordered-dither
  halftone textures, hard offset Y2K shadows, dithered masthead bands;
  dark theme matched; token test + DECISIONS updated
- fix: .card + .card stacking margin leaked into grid layouts, shifting
  every card except the first (the 'always the first item' reports)
- fix: CSP style-src 'self' silently dropped every inline style attribute
  (misaligned save button, stat values, editor attach button, bell badge);
  styles now allow inline, scripts remain strict per §12
- fix: [hidden] is now display:none !important so flex containers cannot
  defeat it (chat panel/footers)
- board + metrics filters live in boxed .toolbar rows with baseline-aligned
  controls; metric stat cards use a uniform .stat layout
- new-conversation dialog: fixed 440px width and 180px results list (no
  more resizing while searching), full-width result rows, picked people
  drop out of the list
- floating messages bubble bottom-right on all pages (except /messages):
  unread badge, mini panel with conversation list, thread view, quick
  composer, live WS updates; toasts moved up to clear it

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/web_test.go

@@ -59,7 +59,7 @@ func TestAnonymousPageRedirectsToLogin(t *testing.T) {
 func TestStaticAssetsServed(t *testing.T) {
 	s := newTestServer(t)
 	tests := map[string]string{
-		"/static/css/app.css": "--bg:#f3ead9", // beige light token from §10
+		"/static/css/app.css": "--bg:#ffffff", // Y2K white-paper light theme
 		"/static/js/theme.js": "data-default-theme",
 		"/static/js/api.js":   "X-CSRF-Token",
 		"/static/js/login.js": "auth/login",
@@ -81,10 +81,11 @@ func TestThemeTokensPresent(t *testing.T) {
 	s := newTestServer(t)
 	rec := get(t, s.Handler(), "/static/css/app.css")
 	css := rec.Body.String()
-	// spot-check both §10 palettes and the square-edge radius
+	// spot-check both palettes (Y2K rework, user-requested deviation from
+	// the §10 beige — see DECISIONS.md) and the square-edge radius
 	for _, tok := range []string{
-		"--bg:#f3ead9", "--accent:#8a5a2b", // light
-		"--bg:#191714", "--accent:#caa15e", // dark
+		"--bg:#ffffff", "--accent:#7a4a14", // light: white paper, brown ink
+		"--bg:#171209", "--accent:#d9a548", // dark
 		"--radius:2px",
 	} {
 		if !strings.Contains(css, tok) {