Modernize the dashboard UI: light theme, semantic colour tokens, accessibility - #70

Focused frontend pass on the Next.js dashboard. No dependency, framework or API changes — same components, same routes.

Theming

• Added the missing light theme. Colours were already CSS custom properties, but the light block was a stub ("rarely used for video platforms") while components hardcoded dark-only palette shades, so light mode was unusable.
• Introduced semantic tokens — brand, success, warning, danger, info — each with its own lightness per theme, and replaced every fixed palette utility (text-violet-400, bg-emerald-500/10, text-zinc-600, bg-black/80, …) with them. Every foreground/surface pair used in the app clears WCAG AA (measured: 4.5–17:1 on both themes, including on the 10% tints the badges use).
• Header theme toggle. The choice is stored in localStorage and applied before first paint by a small inline script, so there is no flash; with no stored choice the OS preference decides, falling back to dark. Transitions are suppressed during the swap.
• Dark --muted-foreground lifted from 55% to 65% lightness (4.3:1 → 7.4:1), and --accent is now a neutral elevation instead of solid violet, which previously produced violet-on-violet hover rows in selects and menus.

Navigation and layout

• Mobile drawer navigation. The header had a menu button that did nothing, so on screens below lg (where the sidebar is hidden) no navigation was reachable. The nav definition now lives in lib/nav.ts and is shared by the sidebar and the drawer.
• Locale switcher in the header — the app already shipped five translations with no way to reach them.
• Content is capped at a max width and page padding, heading scale (text-3xl) and card rhythm are consistent; the errors page no longer double-pads.

Accessibility

• Skip link, <main> landmark, aria-current="page" on the active nav item (the active-state CSS now keys off it), aria-label/title on icon-only controls, aria-hidden on decorative icons, <time datetime> for timestamps, <nav>/<ul> for the footer links.
• Visible focus rings on everything focusable, including whole-card links that previously had none. Row actions that only appear on hover now also appear on focus.
• prefers-reduced-motion is honoured (pulses, pings, hover lifts).

Polish and correctness

• Loading spinners replaced with skeletons where the final shape is known, so cards do not resize when data lands.
• Press feedback on buttons; no-op hovers (text-brand hover:text-brand, bg-primary hover:bg-primary) fixed.
• i18n: "View all" was assembled from common.view + " All"; it is now one key. The <span> brand markup was missing from the non-English dashboard.welcome strings (and de had a stray leading "J"), so the highlight only worked in English. Dashboard dates now use next-intl's formatter instead of the runtime default locale. New keys added to all five bundles.
• The errors page was English-only despite having translations; it now uses them, and error vs warning are visually distinct again (both had collapsed to the same tint).
• Footer linked to /docs and /api, neither of which exists — now points at the docs in this repo.
• Repeated magic values extracted: nav items, sidebar width, app name/version/license, poll interval, severity styles, shell padding.

Docs

• README: Go 1.25 and PostgreSQL 17 (were 1.24/16), frontend stack completed, dashboard development section added.
• ui/README.md was still create-next-app boilerplate (it even credited a font the app does not use); replaced with the real structure, scripts, theming and i18n conventions.

Verification

npx tsc --noEmit clean. npm run build succeeds. npm run test:run: 704/713 passing — identical to main (the 9 failures are pre-existing Radix displayName assertions plus one popover outside-click test). Colour-class assertions in four component tests were updated to the new token classes. npm run lint: the same 2 pre-existing errors as main (errors/page.tsx setState-in-effect, file-upload.tsx use-before-declare), warnings 13 → 12; no new errors introduced and no pre-existing ones fixed. All routes smoke-tested against a production server in all five locales.