Dedup duplicated bridge-plugin strings & theme tokens

[LSDimi]

Follow-up from #11 review (apappascs items 4 + 6). Out of scope for the polish PR; tracked here.

Problem

Several copy-paste config strings and theme tokens are duplicated across multiple files in `packages/bridge-plugin/`. Each duplication is a "keep in sync" comment waiting to drift.

Duplicated strings

`TIER_1_RULES`, `INSTALL_COMMAND`, and `MCP_CONFIG_JSON` appear in:

• `packages/bridge-plugin/src/ui-entry.ts` (TS template literals)
• `packages/bridge-plugin/src/bootloader.html` (JS string literals in inline script)
• `README.md` (markdown — manual sync, acceptable)

Duplicated theme tokens

The cream/accent palette is hardcoded in two CSS `:root` blocks:

• `packages/bridge-plugin/src/bootloader.html:6-17`
• `packages/bridge-plugin/src/ui.html` (matching block)

`bootloader.html` even carries a `/* Tokens aligned with ui.html — keep in sync. */` comment, which is the symptom.

Proposed approach

1. Move `TIER_1_RULES`, `INSTALL_COMMAND` (and any other shared copy) into `packages/bridge-plugin/src/constants.json` (already the `DXT_URL` source of truth, and `MCP_VERSION` is templated via webpack as of PR polish(v0.4.3): centralize DXT_URL, flashButton helper, theme + docs #11).
2. `ui-entry.ts` imports them via `import { TIER_1_RULES, INSTALL_COMMAND } from "./constants.json"` (`resolveJsonModule` is on).
3. `bootloader.html` receives them via webpack `HtmlWebpackPlugin`'s `templateParameters` (same pattern as `MCP_VERSION` and `DXT_URL`).
4. `MCP_CONFIG_JSON` does not need centralizing — it is structurally identical in both files and the only varying field (`MCP_VERSION`) is already templated.
5. Theme tokens: extract the palette into a small shared CSS partial (or into `constants.json` and template into both files). CSS partial is probably cleaner.

Out of scope here

`README.md` will always be a manual sync since GitHub renders it without a build step. Document the rule near `constants.json` so future bumpers know to update README too.

Acceptance

• No `/* keep in sync */` comments left in `bridge-plugin/src/`.
• Editing the strings in `constants.json` updates both `ui-entry.ts`-bundled output and `bootloader.html` after `npm run build`.
• `npm run check` green.