refactor(color): unify color sanitizing and picking behind shared components

- Add AKSRT\Core\Color::sanitize($value, $allow_alpha) as the single PHP
  color sanitizer; replace sanitize_hex_color calls and per-class regexes
  (FloatButtons, FieldSchema, ThemeSearch, icon cards, TicketStatusService)
- SchemaProvider / ControllerBase sanitize `color` fields as colors;
  alpha kept only when the schema sets showAlpha
- Split SchemaProvider OAuth validation and option matching into sibling
  traits to stay under the 1000-line limit
- Add AksColorPicker.vue + utils/color.js mirroring the PHP rules; AksField,
  FloatBtnCommonFields and TicketStatusPanel use it
- Widget background color input now uses wpColorPicker
- Remove dead AksCompositeField dimensions/spacing/background branches and
  the unused Gutenberg ColorPicker var
- Add color-unification contract test; update harness requires and tests

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/widget-system/ticket-spa-config-contract.test.cjs

@@ -80,8 +80,12 @@ test('panels enforce the backend guards instead of trusting the client', () => {
   // 默认状态的编辑/删除入口在前端禁用，但后端 TicketConfigRest 仍有 409 兜底。
   assert.match(status, /disabled: row\.is_default/);
   // 颜色必须落在 TicketStatusService::sanitize_color() 接受的范围内。
-  assert.match(status, /\^#\(\?:\[0-9a-f\]\{3\}\|\[0-9a-f\]\{6\}\)\$/i);
+  assert.match(status, /import \{ toHex \} from '@\/utils\/color\.js'/);
+  assert.match(status, /<AksColorPicker/);
+  assert.doesNotMatch(status, /n-color-picker|HEX_RE/);
   assert.match(status, /#6b7280/);
+  const color = read('assets/admin/src/utils/color.js');
+  assert.match(color, /export const HEX_RE = \/\^#\?\(\[0-9a-f\]\{3\}\|\[0-9a-f\]\{6\}\)\$\/i/);
 
   const prereply = read('assets/admin/src/pages/users/partials/ticket/TicketPrereplyPanel.vue');
   // 排序接口要求全量 ID。