feat(web): add Open VSX theme search

[rynfar]

Adds in-app search and import of editor themes from the Open VSX marketplace, on top of the existing local .vsix/VS Code theme import. ~2,700 insertions including a 776-line openVsxThemes.ts with 526 lines of tests.

Cherry-picked from upstream f0b57ca2313bd7971cefb366d3b3808152b014fc (pingdotgg/t3code#5654). Clean pick — it is built on the OKLCH palette work already merged, so it applies without conflict.

Worth a deliberate decision, not just a sync

This is the first thing in Pylon that reaches a third-party marketplace at runtime: it queries https://open-vsx.org/api/-/search and downloads extension archives to extract their theme JSON. That is a new network dependency and a new trust surface — Pylon previously only imported themes the user already had on disk.

Three new dependencies: jszip (unpack .vsix), jsonc-parser (theme JSON with comments), @noble/hashes (already in the catalog).

Flagging it plainly so the decision is explicit; the developer asked for it knowing the tradeoff.

Pylon-first checks

• No visible "T3 Code"/"T3 Chat" copy introduced in the settings surface
• Applies on top of the merged OKLCH palettes rather than fighting them

Verification

• openVsxThemes, themePalette, vscodeThemeImport, themeBoot pass (85 tests)
• Web typecheck, lint, format clean across 10 changed files
• Confirmed jszip@3.10.1 and jsonc-parser@3.3.1 resolve after install

Not verified: no live marketplace search was performed against open-vsx.org, so the network path and archive extraction are covered only by the bundled tests.

Model: Claude Opus 5 (1M context). Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.4 KiB	+36 B (+0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.8 KiB	5.9 KiB	+36 B (+0.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.4 KiB	11.3 KiB	−4 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.9 KiB	5.8 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 0df9a9e · PR result: f681f9d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.