security(theme): require SHA256 checksum for remote theme install

[ZhuchkaTriplesix]

Summary

ThemeRemoteInstallService.installFromUrl() verifies SHA256 only when a checksum is provided (argument or ?sha256= query param). Without it, any HTTPS response body is imported as a theme.

An active MITM (or compromised CDN) could substitute malicious theme JSON. Impact is lower than extension install (no arbitrary code execution from theme JSON alone) but may affect parser stability, UI, or trust UX.

Affected code

• lib/core/theme/theme_remote_install_service.dart (lines 93–98)
• lib/core/theme/theme_controller.dart

Proposed fix

Options (pick one for v1):

1. Require checksum for all remote installs (strictest; document for theme authors).
2. Trusted catalog only — allow checksum-less install only from pinned/allowlisted hosts.
3. UI consent — warn prominently when installing without checksum.

Align with docs/planned-0.4.3.md / TP-F4 security review notes.

Acceptance criteria

• Defined policy documented in docs/security.md.
• Implementation matches policy with tests.
• User-visible error when checksum required but missing.

Severity

Medium — integrity gap on user-initiated remote theme install.

Related

• Security review 0.4.11
• security(marketplace): require SHA256 checksum before HttpMarketplace install #396 (marketplace checksum — same principle)