Public OBS chat-overlay page. No auth: the token in the path gates the DATA (/api/overlay/{token}/messages), not this page. An invalid token renders an empty transparent overlay. The token is read client side from the URL path; this handler serves the template plus an optional theme.

Theme: query params (?bg=...&accent=...&font=...) are run through overlay_theme.validate_theme on EVERY request (so a hand-edited URL is validated exactly like a preset/AI one) and injected as a :root override. validate_theme is the security boundary: only allowlisted/clamped values reach the CSS, so nothing here can break out of the style block.