feat(banner): per-campaign colour overrides and urgent alerts

Non-default campaigns gain an optional colour override (background / text /
link) in two sets — one for every theme, one for the dark theme only — and an
"urgent" flag.

- Colours ride profile.get as six trailing FlatBuffers strings on
  BannerCampaign (backward-compatible). The client resolves the cascade
  (dark <- dark ?? all, light <- all) per rendered theme and derives the strip
  border from the background in JS (no CSS color-mix, for the old Android
  WebView floor); AdBanner applies them as inline vars scoped to the strip.
- Urgent is resolved entirely server-side: while any enabled, in-window urgent
  campaign exists, computeActiveSet returns only the urgent campaigns and
  bannerFor skips the eligibility gate — so a system notice reaches every viewer
  (paid / hint-holding / no_banner included) and preempts the ordinary feed. No
  wire field; it appears on each viewer's next profile.get.
- Admin console (/_gm/banners): native colour pickers + a live light/dark
  preview of the strip, and an urgent toggle. The default campaign stays plain,
  enforced by the service and a DB CHECK.

Migration 00009 is additive (nullable colour columns + a bool default +
all-or-nothing / hex / default-plain CHECKs) — expand-contract, rollback-safe.

Docs: ARCHITECTURE §10, UI_DESIGN, FUNCTIONAL (+ru). Tests: ads unit (urgent
preempt + colour validation), codec + resolver unit, gateway transcode, and
integration (colour round-trip + urgent bypass against real Postgres).

backend/internal/ads/ads.go

@@ -30,6 +30,15 @@ var ErrDefaultImmutable = errors.New("ads: the default campaign cannot be modifi
 // window or message body).
 var ErrValidation = errors.New("ads: validation")
 
+// ColorSet is an optional per-campaign colour override for the banner strip:
+// background, foreground (text) and link, each a "#rrggbb" hex string. The three
+// are set together or the whole set is absent (a nil *ColorSet).
+type ColorSet struct {
+	Bg   string
+	Fg   string
+	Link string
+}
+
 // Campaign is one advertising placement order with its messages.
 type Campaign struct {
 	ID        uuid.UUID // uuid.Nil on create
@@ -40,6 +49,16 @@ type Campaign struct {
 	StartsAt  *time.Time // nil = open-ended start; always nil for the default
 	EndsAt    *time.Time // nil = open-ended end; always nil for the default
 	Messages  []Message
+	// OverrideAll paints the strip on every theme; OverrideDark, when set, further
+	// overrides the dark theme (the client resolves dark ← dark ?? all ?? token,
+	// light ← all ?? token). Both are nil for the default campaign and for a
+	// campaign that keeps the neutral theme tokens. Non-default only.
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
+	// Urgent forces the banner on every viewer (bypassing eligibility) and, while
+	// any urgent campaign is active, suppresses every non-urgent campaign and the
+	// default remainder. Non-default only; always false for the default campaign.
+	Urgent    bool
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -70,10 +89,15 @@ type Timings struct {
 
 // ActiveCampaign is one campaign in the resolved rotation feed sent to a client:
 // its GCD-reduced show weight and its messages, already resolved to the viewer's
-// language and in display (round-robin) order.
+// language and in display (round-robin) order, plus the optional colour overrides
+// the client applies to the strip (nil = the neutral theme tokens). Urgency is not
+// carried here: it is resolved server-side into the set's membership and the
+// eligibility bypass, so the client only ever renders what it is sent.
 type ActiveCampaign struct {
-	Weight   int
-	Messages []string
+	Weight       int
+	Messages     []string
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
 }
 
 // Eligible reports whether an account should be shown the advertising banner: a
@@ -85,14 +109,20 @@ func Eligible(paidAccount bool, hintBalance int, hasNoBanner bool) bool {
 }
 
 // computeActiveSet builds the resolved rotation feed from the enabled campaigns
-// at time now, in language lang. Campaigns outside their validity window, and
-// campaigns with no messages, are dropped. The default campaign's effective
-// weight is the remainder up to 100% — max(0, 100 - sum of active timed
-// weights) — so it fills unsold inventory and is dropped entirely when timed
-// campaigns already reach 100%. Weights are then reduced by their GCD so the
-// fair rotation cycle stays short. The input is expected to be the enabled
-// campaigns (ActiveCampaigns); disabled ones must already be excluded.
-func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []ActiveCampaign {
+// at time now, in language lang, and reports whether the feed is an urgent one.
+// Campaigns outside their validity window, and campaigns with no messages, are
+// dropped.
+//
+// While any active campaign is urgent, the feed is the urgent campaigns alone —
+// every non-urgent timed campaign and the default remainder are suppressed for
+// the duration (and the caller shows the feed to every viewer, bypassing
+// eligibility). Otherwise the default campaign's effective weight is the
+// remainder up to 100% — max(0, 100 - sum of active timed weights) — so it fills
+// unsold inventory and is dropped entirely when timed campaigns already reach
+// 100%. Weights are then reduced by their GCD so the fair rotation cycle stays
+// short. The input is expected to be the enabled campaigns (ActiveCampaigns);
+// disabled ones must already be excluded.
+func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]ActiveCampaign, bool) {
 	var timed []Campaign
 	var def *Campaign
 	for i := range campaigns {
@@ -108,20 +138,54 @@ func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []Active
 			timed = append(timed, c)
 		}
 	}
+	if urgent := filterUrgent(timed); len(urgent) > 0 {
+		out := make([]ActiveCampaign, 0, len(urgent))
+		for _, c := range urgent {
+			out = append(out, activeFrom(c, lang))
+		}
+		reduceByGCD(out)
+		return out, true
+	}
 	sumTimed := 0
 	for _, c := range timed {
 		sumTimed += c.Weight
 	}
 	out := make([]ActiveCampaign, 0, len(timed)+1)
 	for _, c := range timed {
-		out = append(out, ActiveCampaign{Weight: c.Weight, Messages: resolveBodies(c.Messages, lang)})
+		out = append(out, activeFrom(c, lang))
 	}
 	if def != nil {
 		if dw := 100 - sumTimed; dw > 0 {
-			out = append(out, ActiveCampaign{Weight: dw, Messages: resolveBodies(def.Messages, lang)})
+			a := activeFrom(*def, lang)
+			a.Weight = dw // the default's stored weight is nominal; it fills the remainder
+			out = append(out, a)
 		}
 	}
 	reduceByGCD(out)
+	return out, false
+}
+
+// activeFrom projects a campaign to its rotation-feed entry: its show weight, its
+// language-resolved messages and its colour overrides (carried through by
+// reference, they are read-only).
+func activeFrom(c Campaign, lang string) ActiveCampaign {
+	return ActiveCampaign{
+		Weight:       c.Weight,
+		Messages:     resolveBodies(c.Messages, lang),
+		OverrideAll:  c.OverrideAll,
+		OverrideDark: c.OverrideDark,
+	}
+}
+
+// filterUrgent returns the urgent campaigns among cs, preserving order. It is the
+// preempt selector: a non-empty result makes the whole feed urgent.
+func filterUrgent(cs []Campaign) []Campaign {
+	var out []Campaign
+	for _, c := range cs {
+		if c.Urgent {
+			out = append(out, c)
+		}
+	}
 	return out
 }