feat(ocis): dezky whitelabel theme for the files web UI

Skin OCIS web in the dezky brand so users don't see ownCloud/Infinite Scale.

- Custom theme.json (WEB_UI_THEME_PATH + WEB_ASSET_THEMES_PATH): dezky name,
  slogan, logos (light wordmark for the dark top bar, dark wordmark for the
  light login, favicon), and the full dezky palette — carbon chrome, signal
  yellow as a sparing accent, paper/bone surfaces, dezky semantic colours
- Pin the light theme as default (single variant) so OS-dark / auto-system
  always resolves to it
- Override only index.html via WEB_ASSET_CORE_PATH (OCIS falls back to the
  embedded core per-file): hide the ".versions" footer ("Infinite Scale … /
  ownCloud Web UI …") and set the pre-hydration <title>/theme-color to dezky

Apache-2.0 lets us drop the ownCloud marks without trademark fees. NOTE:
index.html pins the built bundle hashes — refresh it after an OCIS image bump.

infrastructure/docker-compose/docker-compose.yml

@@ -357,11 +357,25 @@ services:
       OCIS_ADD_RUN_SERVICES: audit
       AUDIT_LOG_FILE_PATH: /var/log/ocis/audit.log
       AUDIT_LOG_FORMAT: json
+      # Whitelabel: serve our dezky theme dir under /themes/ and make it the
+      # active web theme (replaces the built-in ownCloud branding — name, logos,
+      # favicon, colours). Apache-2.0 lets us drop the ownCloud marks entirely.
+      WEB_ASSET_THEMES_PATH: /etc/ocis/web-themes
+      WEB_UI_THEME_PATH: /themes/dezky/theme.json
+      # Override ONLY index.html (OCIS layers WEB_ASSET_CORE_PATH over the
+      # embedded core via a fallback FS, so every other asset still serves from
+      # the binary). Our index hides the version footer (.versions) and sets the
+      # pre-hydration <title>/theme-color to dezky. NOTE: index.html pins the
+      # built bundle hashes — refresh it from the live `/` after an OCIS image
+      # bump (or drop this mount) so the script refs stay valid.
+      WEB_ASSET_CORE_PATH: /etc/ocis/web-core
     volumes:
       - ocis_config:/etc/ocis
       - ocis_data:/var/lib/ocis
       - ocis_audit_log:/var/log/ocis
       - ./configs/ocis/csp.yaml:/etc/ocis/csp.yaml:ro
+      - ./configs/ocis/themes:/etc/ocis/web-themes:ro
+      - ./configs/ocis/web-core:/etc/ocis/web-core:ro
     networks: [dezky]
     depends_on:
       - authentik-server