Back unbacked ui tokens (bgSubtle/fgFaint/borderStrong) with a theme-aware default layer

[mgoldsborough]

Closes #17.

Problem

tokens.bgSubtle, tokens.fgFaint, and tokens.borderStrong reference CSS vars — --color-background-tertiary, --color-text-tertiary, --color-border-secondary — that no host injects (not the preview harness, not the NimbleBrain host). They always resolve to their hardcoded light fallbacks, so they're theme-blind: pair one with a theme-aware token and you get white-on-white in dark mode while light looks fine and tsc/build pass.

This isn't only a downstream-app footgun — the SDK's own components use these three tokens: Card, ListRow, Prose, Table, Badge, Button, Avatar, SearchField, SegmentedControl, EmptyState, StatusDot, and typography. So the shipped component library itself renders broken in dark mode.

Why not fix the fallback: a CSS var(--x, fallback) fallback is a static literal that fires exactly when --x is unset — the moment there's no theme signal to branch on. So it can't be light-in-light / dark-in-dark. The fix must add a definition layer, not a smarter fallback.

Why not a [data-theme] stylesheet (the issue's first sketch): the host applies variables as inline styles on document.documentElement and switches themes by re-sending a different value map — it never toggles a data-theme attribute, and a :root {} rule loses specificity to the host's inline styles anyway. So a static dark block would never activate. The fix has to live in the same inline-application path the SDK already owns, keyed on hostContext.theme.

Fix

• theme-defaults.ts — a neutral default theme backing every color var the token contract references, in both light and dark. Applied to :root beneath the host's variables, keyed on the active mode, so:
  • the host's (brand) values still win for the keys it provides, and
  • any var the host omits resolves to a theme-correct neutral default.
  • Works against an incomplete host, a standalone connect() widget, or a third-party host. Values stay neutral — brand still arrives only by host injection, preserving the library's host-agnostic design.
• Single injection path — applyThemeVariables(mode, hostVars) replaces three near-duplicate inline injectors in core.ts, connect.ts, and the React <SynapseProvider>. No public API change.
• Preview harnesses (vite plugin host + preview server) now inject the three vars in both themes, so synapse dev/preview matches a complete host. Also removed a duplicate --color-text-primary key in those maps.
• Regression guard in tokens.test.ts: every color var a token references must be defined in both light and dark, with no dead defaults, and light defaults equal to the token fallbacks (no light-mode regression). This fails the instant someone adds a color token nothing backs.

Verification

npm run ci green — lint, typecheck, build, and 385 tests (incl. 4 new guard tests) pass. The default theme is bundled into all shipped artifacts including the IIFE widget builds.

Follow-ups (separate)

• Make the NimbleBrain host theme exhaustive (define the three vars in both themes) — defense in depth, in the host repo.
• Remove the "avoid bgSubtle/fgFaint/borderStrong" gotcha from the public synapse skill once this releases.