feat(housekeeping): add per-hotel theme manager with import/export and background

Theme Manager under /admin-next/hotel/theme-manager lets the owner save, apply, rename, delete, import, and export custom themes, plus set a custom site background by URL or upload. Themes are stored in WebsiteSetting/custom_themes JSON so they survive CMS updates.

src/lib/theme-bg.ts

@@ -0,0 +1,52 @@
+// Site background settings shared by the Theme Manager, its server actions,
+// and ThemeVars. Kept in a plain module because it is imported by client
+// components and "use server" files.
+
+export const BACKGROUND_KEYS = [
+	"background_image",
+	"background_position",
+	"background_size",
+	"background_repeat",
+] as const;
+export type BackgroundKey = (typeof BACKGROUND_KEYS)[number];
+
+export const BACKGROUND_POSITIONS = [
+	"center center",
+	"top center",
+	"top left",
+	"top right",
+	"center left",
+	"center right",
+	"bottom center",
+	"bottom left",
+	"bottom right",
+] as const;
+
+export const BACKGROUND_SIZES = ["cover", "contain", "auto"] as const;
+
+export const BACKGROUND_REPEATS = [
+	"no-repeat",
+	"repeat",
+	"repeat-x",
+	"repeat-y",
+] as const;
+
+export const BACKGROUND_DEFAULTS: Record<BackgroundKey, string> = {
+	background_image: "",
+	background_position: "center center",
+	background_size: "cover",
+	background_repeat: "no-repeat",
+};
+
+/**
+ * A URL accepted as a custom site background. Blocks `javascript:`, data
+ * URIs and any character that could break out of CSS `url("...")` (quotes,
+ * backslashes, backticks, whitespace).
+ */
+export function isSafeBackgroundUrl(value: string): boolean {
+	const URL_SAFE = /^[a-zA-Z0-9/:_\-.?&=%~+#]+$/;
+	return (
+		(value.startsWith("/") || /^https?:\/\/[^\s"'`\\]+$/i.test(value)) &&
+		URL_SAFE.test(value)
+	);
+}