fix(web): sanitize token values on save + add PUT body forwarding test (ATB-59)

apps/web/src/routes/__tests__/admin-themes.test.tsx

···
     expect(location).toContain("error=");
     expect(decodeURIComponent(location).toLowerCase()).toContain("unavailable");
   });
+
+  // ── PUT body forwarding ────────────────────────────────────────────────────
+
+  it("forwards name, colorScheme, tokens, and fontUrls to the AppView PUT call", async () => {
+    setupAuthenticatedSession([MANAGE_THEMES]);
+    mockFetch.mockResolvedValueOnce(mockResponse({ id: "1" }));
+
+    const routes = await loadThemeRoutes();
+    await routes.request("/admin/themes/abc123/save", {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        cookie: "atbb_session=token",
+      },
+      body: new URLSearchParams({
+        name: "Saved Theme",
+        colorScheme: "dark",
+        fontUrls: "https://fonts.example.com/font.css\nhttps://fonts.example.com/font2.css",
+        "color-bg": "#000000",
+      }).toString(),
+    });
+
+    // Calls: 1 = session, 2 = members/me, 3 = AppView PUT
+    const putCall = mockFetch.mock.calls[2];
+    const putBody = JSON.parse(putCall[1].body as string);
+    expect(putBody.name).toBe("Saved Theme");
+    expect(putBody.colorScheme).toBe("dark");
+    expect(putBody.fontUrls).toEqual([
+      "https://fonts.example.com/font.css",
+      "https://fonts.example.com/font2.css",
+    ]);
+    expect(putBody.tokens["color-bg"]).toBe("#000000");
+  });
 });

apps/web/src/routes/admin-themes.tsx

···
     const tokens: Record<string, string> = {};
     for (const tokenName of ALL_KNOWN_TOKENS) {
       const raw = rawBody[tokenName];
-      if (typeof raw === "string" && raw.trim()) {
-        tokens[tokenName] = raw.trim();
+      if (typeof raw !== "string") continue;
+      const safe = sanitizeTokenValue(raw.trim());
+      if (safe !== null && safe !== "") {
+        tokens[tokenName] = safe;
       }
     }