ui: fix admin/docs theme flash + persist sidebar open/closed state

Theme flash (admin pages, docs, stats, progress — anywhere SSR'd):
the JWT middlewares built the context user WITHOUT the Theme column,
so every page rendering theme-{user.Theme} from c.Get("user") painted
an empty class (:root tokyo-night default) and only settled on the real
theme after initializeTheme -> loadUserTheme round-tripped the server.
Both middlewares now carry liveUser.Theme into the context user;
verified live: /admin /stats /progress /docs /docs-deep /dashboard
/collections all SSR theme-hackerman.

Defense in depth for the same bug: loadTheme() no longer re-applies
localStorage over a server-rendered body theme (applyTheme records even
the default, so any signed-out visit baked tokyo-night into localStorage
and every signed-in page flipped to it post-paint). Public auth/landing
bodies dropped their hardcoded theme classes so ThemeFlashGuard's
pre-paint html class actually governs them; docs theme <select> now
syncs from the body class and re-syncs after the profile fetch.

Sidebar state (the unpleasant part): the app sidebar's openPanel was
reinitialized from the pathname on every load; it now restores from
localStorage ('sidebar-open-panel') with the pathname default as
fallback and -persists every toggle. Docs sidebar sections/groups
carry data-key attributes and toggleCollapsible persists collapsed
state per key ('docs-nav-state'); restoreDocsNav() applies it at init —
server-rendered defaults still govern first visit.

make test green; rendering ownership OK (no new inline scripts); 146
vitests pass; live-verified SSR classes on 7 pages.

internal/router/router.go

@@ -149,6 +149,7 @@ func createOptionalAuthMiddleware(cfg *Config) echo.MiddlewareFunc {
 				Username: claims["user_username"].(string),
 				Role:     claims["user_role"].(string),
 				Timezone: liveUser.Timezone,
+				Theme:    liveUser.Theme, // SSR body class; see the required middleware
 			})
 			return next(c)
 		}
@@ -211,6 +212,11 @@ func createJWTMiddleware(cfg *Config) echo.MiddlewareFunc {
 				Username: claims["user_username"].(string),
 				Role:     claims["user_role"].(string),
 				Timezone: liveUser.Timezone,
+				// SSR pages render `theme-{user.Theme}` into <body>; without
+				// this the class renders empty and every page painted the
+				// :root default (tokyo-night) before JS caught up — the
+				// admin/docs theme flash.
+				Theme: liveUser.Theme,
 			})
 			return nil
 		},