feat(theme): per-app accent: pm gives window manifest accent before app runs (display ACCENT, refused after BUFFER); theme::with_accent keeps hue, shifts lightness until contrast passes, else theme accent; tally pink

docs/apps.md

@@ -72,7 +72,8 @@ required = ["display"]      # cannot work without; denied = not installed
 optional = []               # works without; the user decides each
 
 [appearance]
-accent = "#e91e63"          # optional: checked for format here, contrast by K-UI
+accent = "#e91e63"          # optional: its primary buttons and active states;
+                            # the display adapts its lightness to each theme
 ```
 
 The subset: `[table]` headers, `key = "string"`, `key = ["a", "b"]` on one

docs/ipc.md

@@ -197,7 +197,12 @@ one in use (`THEME`, two words a call, `theme::wire`). Only init picks it
 signed-in user's choice at sign-in, the default at sign-out, and both
 again (with `SET_USER`) when the display restarts. A user chooses through
 Settings: `types::spawn::SET_THEME` on init's session copy, which init
-keeps sealed in `users/<id>/settings/theme`.
+keeps sealed in `users/<id>/settings/theme`. An app's accent (its
+manifest's) is given to its window by the permission manager before the
+app runs (`ACCENT`, refused once anyone has asked for the buffer, so an
+app cannot pick its own); the theme that window reads carries it, its
+lightness moved until it passes contrast (`theme::with_accent`), or the
+theme's own accent if it cannot, is black or white, or looks destructive.
 
 Input reaches apps through the display server, the input server's only
 client. It subscribes to the input server with a notification, drains it