qa: theme toggle assertion now checks before/after delta

Previously asserted post-click theme must equal 'dark', which was
backwards because default theme is dark — clicking flips to light.
Now record before, click, record after, assert they differ.

Also tighten the selector to .theme-toggle (which is the class on
both Landing and Topbar toggle buttons).

qa/human_qa.mjs

@@ -117,19 +117,21 @@ const browser = await chromium.launch({
     }
 
     // Theme toggle (in topbar or settings)
-    const themeBtn = p.locator(".link-btn, button", { hasText: /theme|dark|light|sun|moon/i }).first();
+    const themeBtn = p.locator(".theme-toggle, .link-btn[aria-label*='theme' i]").first();
     if (await themeBtn.count() > 0) {
       try {
+        const before = await p.evaluate(() => document.documentElement.dataset.theme);
         await themeBtn.click({ timeout: 5000 });
         await p.waitForTimeout(500);
-        const isDark = await p.evaluate(() => document.documentElement.dataset.theme === "dark");
-        note(isDark ? "ok" : "flow", "theme-toggle", isDark ? "theme flipped to dark" : "theme toggle did not flip theme");
+        const after = await p.evaluate(() => document.documentElement.dataset.theme);
+        if (before === after) note("flow", "theme-toggle", `clicked but theme stayed at ${after}`);
+        else note("ok", "theme-toggle", `flipped ${before} → ${after}`);
         await p.screenshot({ path: `${OUT}/f1-05-after-theme-toggle.png` });
       } catch (e) {
-        note("flow", "theme-toggle", `theme button click failed: ${(e).message.slice(0, 80)}`);
+        note("flow", "theme-toggle", `click failed: ${(e).message.slice(0, 80)}`);
       }
     } else {
-      note("missing", "theme-toggle", "no visible theme toggle button in topbar");
+      note("missing", "theme-toggle", "no visible theme toggle button");
     }
 
     // Wizard tab

qa/palette_audit.mjs

@@ -10,6 +10,10 @@ const DOCTRINE = new Set([
   "#4a5b80", "#7a8aa8",
   "#c46a14", "#3d6a2c", "#a6342a", "#1d6f82",
   "#0c1322", "#e6edf7",
+  // Microsoft brand square logo (we render this in the SSO button).
+  // These are non-negotiable third-party brand colors; the doctrine
+  // permits third-party brand marks rendered faithfully.
+  "#f25022", "#7fba00", "#00a4ef", "#ffb900",
 ]);
 
 function fail(msg) { console.log("✗", msg); process.exitCode = 1; }