Give the two viewers one shared visual language

[plearaj]

A design pass on templates/shared/viewer.template.html and templates/shared/report.template.html. Presentation only — no behavior change, no new controls, no dependency.

The two files install side by side into .code-flow/ and their outputs land side by side in Code_Flows/, but until now they shared only a localStorage key. They now share a token set: a warm paper light theme and a cool slate dark theme, one type scale, one spacing rhythm, one shadow treatment.

What did not change

• validate() in either file, and neither sentinel moved — verified: zero lines matching the validator's own patterns appear in the diff.
• Exactly one data token per file, and the runtime "__FLOW" + "_DATA__" reassembly.
• No network reference of any kind. The only http:// occurrences are the two SVG XML namespaces, which is what test_scaffold_is_self_contained excises.
• innerHTML appears only as = "".
• No test regex was touched and no pinned copy was reworded. The honesty phrasings are load-bearing and were left exactly as they were.

Accessibility

color-scheme is now set in both files, closing a minor from the Phase 3b final review — the report viewer ships the product's only <select> elements, and their popups and the page scrollbars previously rendered in the OS theme rather than the page's.

Measured in the browser against real fixture data:

	light	dark
body text	13.17:1	14.34:1
severity chip	5.62:1	5.58:1

Severity is never carried by hue alone — the chip states HIGH / MEDIUM / LOW in words at weight 700.

Verification

uv run --group dev pytest -q     249 passed
npm test                          33 passed

Beyond the suites, the pages were driven in a browser against examples/sample-report.json and examples/sample-flow.json:

• Populated report — renders; coverage leads; "catalogued" not "all".
• Empty findings, the screen this product most needs to get right — zero green-dominant elements, zero checkmark or celebration glyphs, reads "No findings — clean within what was mapped" and "never a clean bill of health". The filter bar is not constructed at all in that branch, so no empty container reads as a pass.
• Malformed JSON — the error card is genuinely visible (offsetHeight > 0), carrying the parser message and the </ escaping tip. This is the one thing the suite structurally cannot verify.
• Flow viewer — 37 rendered elements, a 660×908 graph bbox, no error card.

Screenshots could not be captured. The Browser pane does not composite frames in this environment, so verification was DOM and computed-style level, not pixel level. The repo's mandated pre-publish manual browser pass (npm run release-check) remains the pixel check and is not satisfied by this PR.

Known, not fixed here — both pre-existing

• On the malformed-JSON path the theme script never runs, so the error card ignores the OS dark preference. Affects both scaffolds and predates this change.
• The flow viewer's clickable sidebar rows are mouse-only — no keyboard affordance. A real accessibility gap, out of scope for a visual pass.

🤖 Generated with Claude Code