feat: single-source theme discovery replaces three hardcoded whitelists

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/core.py

@@ -4,12 +4,29 @@ import json
 import re
 import socket
 import uuid
+from pathlib import Path
 from urllib.parse import urlparse, unquote
 import bleach
 from . import db
 
+ROOT = Path(__file__).resolve().parent.parent
+
+def discover_themes():
+    """Discover built-in themes from themes/*/manifest.json (single source of truth)."""
+    found = []
+    for entry in sorted((ROOT / 'themes').iterdir()):
+        if not entry.is_dir() or entry.name.startswith('_'):
+            continue
+        try:
+            manifest = json.loads((entry / 'manifest.json').read_text(encoding='utf-8'))
+        except (OSError, ValueError):
+            continue
+        if isinstance(manifest, dict) and manifest.get('id') == entry.name:
+            found.append(entry.name)
+    return tuple(found)
+
 TYPES = ('page','product','post','service','case','brand','vehicle','other')
-THEMES = ('automotive','industrial','corporate','minimal')
+THEMES = discover_themes()
 ALLOWED_TAGS = ['p','br','b','i','u','em','strong','h1','h2','h3','h4','h5','h6','ul','ol','li','blockquote','pre','code','a','img','figure','figcaption','table','thead','tbody','tr','th','td','hr','div','span']
 ALLOWED_ATTRS = {'a':['href','title','target','rel'], 'img':['src','alt','title','loading','width','height'], 'td':['colspan','rowspan'], 'th':['colspan','rowspan']}