fix: do not clear card color when update omits the field

[Lightshadow02]

• Resolves: Card update API clears the existing color when the color field is omitted #8131
• Target version: main

Summary

CardService::update() unconditionally called $card->setColor($color), so any API client that omits the color field on a card update (mobile clients, scripts, integrations) silently wiped the stored card color.

This applies the exact mechanism already used for the done field: the controllers build an OptionalNullableValue only when the request body actually contains a color key (array_key_exists), and the service only touches the color when the wrapper is present:

• field omitted → color kept (the fix)
• explicit null or "" → color cleared
• hex string → color set

The service guards with is_string(), so malformed non-scalar payloads (e.g. an array) are treated as "clear" instead of being string-cast. Note: an unquoted numeric JSON value ("color": 123456), which previously coerced to the string "123456", now also clears — strings are the documented type for this field.

The web frontend always sends the full card object including color, so UI behaviour is unchanged. Covered by four new PHPUnit cases (kept / cleared via null / cleared via empty string / set).

How to test

1. Set a card color in the web UI
2. PUT /index.php/apps/deck/cards/{cardId} with a body that contains title/stackId/type/order but no color key
3. Before: color wiped. After: color kept. Sending "color": null still clears it.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Documentation (manuals or wiki) has been updated or is not required

🤖 Generated with Claude Code