fix(web): block } in sanitizeTokenValue to prevent CSS block-escape injection (ATB-59)

apps/web/src/routes/admin-themes.tsx

···
 /** Drop token values that could break the CSS style block. */
 function sanitizeTokenValue(value: unknown): string | null {
   if (typeof value !== "string") return null;
-  if (value.includes("<") || value.includes(";") || value.includes("</")) return null;
+  if (value.includes("<") || value.includes(";") || value.includes("}")) return null;
   return value;
 }