feat(admin): branding edits The Cafe Deck tokens; theme saves need the admin

- The colour section now edits the deck tokens (card back, card stock and
  inks, foil and signals, text) with tokens.css values as defaults; the top
  and tab bar section only lists values theme.js still applies.
- Retired sections (home tiles, quick actions, game menu sheet, menu buttons,
  chips, bot cards, game gradients, pill radii) are gone; saving them did
  nothing after the redesign, and their old defaults could have overridden it.
- Emoji replacement slots become icon overrides (icon_<name>); slots that are
  now drawn icons are dropped from the asset list. Board defaults match the
  printed boards.
- POST /api/branding.php required no login at all: anyone could rewrite the
  theme for every player. It now requires the branding admin session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/branding.php

@@ -41,7 +41,15 @@ if ($method === 'GET') {
 }
 
 if ($method === 'POST') {
-    // Admin endpoint — saves theme values to Supabase
+    // Admin endpoint: saves theme values to Supabase. Only the signed-in
+    // branding admin (/admin/branding.php, same origin, session cookie) may
+    // write; without this check anyone could repaint the app for every player.
+    session_start();
+    if (empty($_SESSION['branding_auth'])) {
+        http_response_code(401);
+        echo json_encode(['error' => 'Sign in to /admin/branding.php first']);
+        exit;
+    }
     $input = getInput();
     $action = $input['action'] ?? '';