#427 Theme store: download, verify and update catalog themes

[Anonymous]

Originally created by: kristofferR

Problem

Chatpane needs to list catalog themes, fetch one when it is chosen, keep it safe and current, and work offline.

Design

All network work in Rust; the Messenger page gets no access.

• Index: fetched from https://raw.githubusercontent.com/kristofferR/Carrier/main/themes/index.json (#426) when Settings shows the gallery and with the existing update check; cached in the app cache dir for 24 h. No redirects off that host; response size capped.
• Choosing a catalog theme (no separate install step): download the CSS if missing or outdated, enforce bytes while streaming, check SHA-256, run the existing check_css, write themes/<id>.css, record { id, version, sha256 } in themes/store.json, then select and apply it. On any failure keep the current theme and return the reason for Settings' notice.
• Updates: with the update check, any downloaded catalog theme whose index version is newer is replaced in place and re-applied if selected. A theme dropped from the catalog keeps working.
• Compatibility: Chatpane has a THEME_HOOKS_VERSION; entries needing more are listed but can't be chosen ("Needs a newer Chatpane").
• Offline: downloaded themes work; the gallery uses the cached index; choosing one not yet downloaded says it needs a connection.
• Remove: deletes the file and its store.json entry; if it was selected, fall back to Default.
• Ids: catalog themes are tracked in store.json, so an imported file with the same name doesn't collide (imports get a suffix).
• Previews: fetched and cached by Rust too, handed to Settings as data URLs, so Settings never loads remote content.
• list_themes returns built-ins, imported and catalog themes in one list with downloaded, source and available flags.

Testing

• Unit tests: hash mismatch, oversize, failed check_css, version bump, removed-from-catalog, offline cache, id collision.
• End to end against a local copy of the catalog.

Part of [#434].