feat(render): add startup theme palette support for Q-Apps via _qdnThemePalette (Qortal-Hub#231)

[QuickMythril]

Summary

This PR adds Core-side support for startup theme palette delivery to Q-Apps by accepting an optional themePalette query parameter on /render/* routes and injecting it into rendered HTML as:

var _qdnThemePalette = <object-or-null>;

This complements the Hub work in:

• feat: expose resolved Hub palette to Q-Apps via THEME_CHANGED (fixes #231) Qortal-Hub#256

and addresses the remaining startup-path gap for:

• Sharing Qortal-Hub Themes with Q-Apps Qortal-Hub#231

Problem

Hub now sends runtime theme updates with full palette (THEME_CHANGED with { theme, palette }), but Q-Apps also need palette data immediately at startup (before runtime postMessage) to avoid first-paint theme drift.

Before this PR, Core only injected startup globals for mode/language (_qdnTheme, _qdnLang) and had no startup palette global.

What This PR Changes

1) Render API support (additive)

/render/* endpoints now accept optional query param:

• themePalette (string, URL-encoded JSON object)

Updated:

• RenderResource to read and forward themePalette to the renderer.

2) Renderer plumbing

ArbitraryDataRenderer now carries an optional themePalette field and passes it into HTMLParser.

3) HTML startup global injection

HTMLParser now:

• accepts themePalette,
• validates/parses it as JSON object only,
• injects startup global:
  • var _qdnThemePalette = <object-or-null>;
• falls back to null when missing, invalid JSON, or non-object payload,
• preserves existing globals (_qdnTheme, _qdnLang, _qdnContext, etc.) unchanged.

4) Injection safety

Palette JSON is normalized and escaped for inline script context (e.g. <, >, &, line separators) before interpolation.

5) Dev proxy parity

DevProxyServerResource now reads optional themePalette and passes it to HTMLParser so dev mode behavior matches render mode.

6) Internal link propagation support (q-apps.js)

When Q-Apps build internal resource URLs, Core q-apps.js now appends:

• theme
• lang
• optional themePalette (JSON.stringify + encodeURIComponent, fail-safe)

It also strips themePalette in URL parsing cleanup used for navigation history.

Supported themePalette Format

themePalette must be a URL-encoded JSON object string.

Example:

• Raw JSON:
  • {"primary":"#111111","surface":{"main":"#ffffff"}}
• Query value:
  • themePalette=%7B%22primary%22%3A%22%23111111%22%2C%22surface%22%3A%7B%22main%22%3A%22%23ffffff%22%7D%7D

Behavior:

• Valid object: injected as object.
• Missing / invalid JSON / non-object: injected as null.

Backward Compatibility

• Existing behavior for _qdnTheme, _qdnLang, and render flows remains unchanged.
• Existing clients that only use theme mode continue to work.
• Q-Apps/Core paths that ignore themePalette continue to work.
• No breaking API changes.

Validation

• Added parser-level tests:
  • valid object injection,
  • invalid JSON fallback to null,
  • non-object fallback to null.
• Build/test checks passed:
  • mvn -DskipJUnitTests=false -Dtest=org.qortal.test.api.HTMLParserTests test
  • mvn -DskipTests package

End-to-End with Hub + Q-Place

With Hub feature/theme-sharing + Hub PR #256 behavior and this Core PR:

• Q-Apps get full palette at startup from Core-injected _qdnThemePalette,
• Q-Apps continue receiving runtime updates via THEME_CHANGED ({ theme, palette }).

qortal://APP/qplace supports this feature and can be used for verification:

1. Open Q-Place in Hub.
2. Confirm startup theme matches current Hub palette immediately.
3. Change Hub theme mode/palette.
4. Confirm Q-Place updates live without full app restart.