feat: restyle the OAuth pairing page with brand logo and light/dark theme

[mirecekd]

What

The page where the pairing code is entered during the Grok OAuth flow was an unstyled HTML form. This restyles it:

• brand logo (the existing brand/icon.svg, inlined) above the title
• light and dark theme via prefers-color-scheme, HA-blue accent
• responsive card layout, large monospace pairing-code field (auto-focused), full-width primary button
• the callback address and the permission summary are visually separated

No text, translation key or behaviour changes; all five languages render as before. The page still shows only entity/action counts, never names or states.

Security

The consent page CSP was default-src 'none', which would block even a single inline <style>. Instead of adding unsafe-inline, the CSP now carries style-src 'sha256-...' computed from the exact stylesheet text (STYLE_SOURCE in oauth_page.py), so only that one stylesheet is allowed. Scripts, images, fonts, frames and the form-action callback-origin rule are unchanged.

Tests / verification

• 89 Python tests and tools/check_package.py pass on top of current main (2026.10.5.2).
• tests/test_http.py CSP assertions updated to the new header (and assert there is no unsafe-inline).
• Rendered in headless Chrome (light and dark) with the real CSP header; also verified on a live HA instance behind a custom HTTPS origin that the style hash in the header matches the hash of the served stylesheet.
• docs/ARCHITECTURE.md notes the hashed style-src.

Not included

I also tried advertising the brand icon via serverInfo.icons in the MCP initialize response. grok.com currently shows a generic placeholder for every custom connector regardless of server metadata, so that change is dropped from this PR.