feat: add resolveUserThemePreference to theme resolution waterfall

apps/web/src/lib/theme-resolution.ts

···
   return parts[4] ?? null;
 }
 
+/**
+ * Reads the user's theme preference cookie for the active color scheme and
+ * validates it against the policy's availableThemes list.
+ * Returns the validated AT URI, or null if absent, stale, or choice not allowed.
+ */
+export function resolveUserThemePreference(
+  cookieHeader: string | undefined,
+  colorScheme: "light" | "dark",
+  availableThemes: { uri: string }[],
+  allowUserChoice: boolean
+): string | null {
+  if (!allowUserChoice) return null;
+  const cookieName = colorScheme === "light" ? "atbb-light-theme" : "atbb-dark-theme";
+  const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${cookieName}=([^;]+)`));
+  if (!match) return null;
+  const uri = match[1].trim();
+  return availableThemes.some((t) => t.uri === uri) ? uri : null;
+}
 
 /**
  * Resolves which theme to render for a request using the waterfall:
- *   1. User preference   — not yet implemented (TODO: Theme Phase 4)
- *   2. Color scheme default — atbb-color-scheme cookie or Sec-CH hint
- *   3. Forum default      — fetched from GET /api/theme-policy (cached in memory)
- *   4. Hardcoded fallback — neobrutal-light or neobrutal-dark per color scheme
+ *   1. Detect color scheme — atbb-color-scheme cookie or Sec-CH hint
+ *   2. Fetch theme policy  — GET /api/theme-policy (cached in memory)
+ *   3. User preference     — atbb-light-theme / atbb-dark-theme cookie (validated against policy)
+ *   4. Forum default       — defaultLightThemeUri / defaultDarkThemeUri from policy
+ *   5. Hardcoded fallback  — neobrutal-light or neobrutal-dark per color scheme
  *
  * Pass a ThemeCache instance to enable in-memory TTL caching of policy and
  * theme data. The cache is checked before each network request and populated
···
   cache?: ThemeCache
 ): Promise<ResolvedTheme> {
   const colorScheme = detectColorScheme(cookieHeader, colorSchemeHint);
-  // TODO: user preference (Theme Phase 4)
 
   // ── Step 1: Get theme policy (from cache or AppView) ───────────────────────
   let policy: CachedPolicy | null = cache?.getPolicy() ?? null;
···
     }
   }
 
-  // ── Step 2: Extract default theme URI and rkey ─────────────────────────────
+  // ── Step 2: User preference or forum default URI ───────────────────────────
+  const userPreferenceUri = resolveUserThemePreference(
+    cookieHeader,
+    colorScheme,
+    policy.availableThemes,
+    policy.allowUserChoice
+  );
   const defaultUri =
-    colorScheme === "dark" ? policy.defaultDarkThemeUri : policy.defaultLightThemeUri;
+    userPreferenceUri ??
+    (colorScheme === "dark" ? policy.defaultDarkThemeUri : policy.defaultLightThemeUri);
   if (!defaultUri) return fallbackForScheme(colorScheme);
 
   const rkey = parseRkeyFromUri(defaultUri);