feat(storefront): theme presets + seller identity across all seller-facing surfaces

[OisinKyne]

feat(storefront): per-hostname branding overrides

An offer bound to its own hostname is its own product — it should be able to carry its own identity instead of leaking the storefront-wide brand. Branding attaches to origins: the storefront profile covers the default tunnel origin; this PR adds a per-origin override for hostname-bound offers.

What's here

• spec.branding on the ServiceOffer CRD (displayName, tagline, logoUrl, theme, accentColor, faviconUrl, ogImageUrl, description) — schema-validated (theme enum, accent hex pattern), with field-wise merge semantics: set fields override the storefront profile, empty fields inherit. One offer per hostname is already enforced, and multi-route offers share their origin's identity.
• Controller: origin bundles (landing page + offer-scoped openapi.json) render the merged identity, including a new "About {operator}" richtext section fed by the branding description. Contact email deliberately stays storefront-wide.
• Verifier: the branding patch rides RouteRule.Branding from the ServiceOffer informer into the 402 renderer and SIWX sign-in page, so paywall pages on a branded origin show that origin's name/logo/theme.
• CLI: obol sell info set --hostname audit.acme.io --display-name AuditCo --theme obol … resolves the hostname-bound offer and merge-patches spec.branding; obol sell info reset --hostname … clears specific fields (merge-patch nulls) or the whole block. Passing --contact-email with --hostname errors with an explanation.

Testing

Controller test pinning the merge on landing + openapi surfaces (override wins, email inherits); verifier test asserting the branded origin's 402 shows the patch identity and the storefront name does not leak; CLI flag-surface test; CRD embed validation.

🤖 Generated with Claude Code