fix: MPS-24 — systemic dark-mode token sweep (close the whole bug class)

After fixing the same dark-mode bug 4x one surface at a time, swept
it system-wide. Root pattern: var(--name, fallback) where --name is
NOT a token in tokens.css -> the light fallback applied in BOTH themes
-> dark broken. Offenders: --color-surface*, --color-border*,
--color-text*, --text-color, --surface* (none are tokens).

- Remapped all 53 occurrences in common.css to the real theme-aware
  tokens (--surface-base/-dim/-container, --border-default,
  --text-primary/-body/-muted), KEEPING each fallback literal
  (comma-boundary sed). Diff verified: exactly 53/53 var-name-only
  swaps, no fallback/structure change, line count unchanged.
- Light mode: identical where token==fallback (#fff, off-whites);
  minor canonical nudges where they differ (muted #888->#666, body
  #333->#515151, primary #111->#333, borders ->#e0e0e0) — the design
  system's intended values, the 'light looks better' direction.
- Dark mode fixed app-wide (wells, suggest cards, counts, checksum
  table, and every other surface using these vars).
- Excluded (not the bug): --shop-theme-*, --color-accent, --pico-*,
  --primary-color, the --dark-* family, theme-neutral font/size vars.
- CLAUDE.md: DARK-MODE TRAP rule + pre-commit grep gate. mps-24.md
  Phase 2.8r. 1151 passed (CSS-only).

docs/tickets/mps-24.md

@@ -363,6 +363,27 @@ Tests (`test_functional.py::TestProductTagsSpa`):
 Deferred (occasional click, not the hot path): AJAX-ifying the
 "Suggest categories" link — still a full navigation by design.
 
+**Phase 2.8r — systemic dark-mode token sweep** (shipped 2026-05-18):
+after fixing the same dark-mode bug 4× one-surface-at-a-time (wells,
+suggest cards, counts, checksum table) the operator asked for a
+systemic pass. Root pattern: CSS referenced `var(--name, fallback)`
+where `--name` is **not** a token in `tokens.css` (`--color-surface*`,
+`--color-border*`, `--color-text*`, `--text-color`, `--surface*`), so
+the light `fallback` applied in BOTH themes → dark broken. Swept all
+53 occurrences in `common.css` to the real theme-aware tokens
+(`--surface-base/-dim/-container`, `--border-default`,
+`--text-primary/-body/-muted`), **keeping each fallback literal**
+(comma-boundary sed; verified diff is exactly 53/53 var-name-only
+swaps, no fallback/structure change, line count unchanged). Light
+mode now uses canonical token values: identical where token==fallback
+(`#fff`, off-whites); minor design-consistent nudges where they
+differ (muted `#888→#666`, body `#333→#515151`, primary `#111→#333`,
+borders → `#e0e0e0`). Dark mode fixed app-wide. Excluded (not the
+bug / runtime-defined): `--shop-theme-*`, `--color-accent`,
+`--pico-*`, `--primary-color`, the `--dark-*` family (dark fallbacks,
+dark-only rules), and theme-neutral font/size/radius vars. CLAUDE.md
+gains a "DARK-MODE TRAP" rule + pre-commit grep gate.
+
 **Phase 2.8q — click-to-copy hashes + styled checksum table** (shipped
 2026-05-18): operator: make the checksum hashes click-to-copy (they
 were unstyled, overflowing the column). New reusable