Task #603: distinct, non-purple home-tile colours

The four default home-screen tiles (Notes / Services / Meetings /
Admin) showed up as three blue tiles + one orange one. Root cause was
NOT the DB — seed.ts already gave each app a distinct hex — but the
`gradientForColor()` mapper in `artifacts/tx-os/src/pages/home.tsx`
only recognised blue/purple/green/orange/pink/teal, so yellow
(#eab308), red (#ef4444), and the dark navy meetings colour all fell
through to the default blue gradient.

Changes:

1. `artifacts/tx-os/src/index.css` — added `.icon-tile-red` and
   `.icon-tile-yellow` gradients matching the existing tile style.

2. `artifacts/tx-os/src/pages/home.tsx` — `gradientForColor()` now
   maps red/dc2626 and yellow/facc15 first. Purple branch stays for
   admin-custom apps but no seeded row uses it.

3. `scripts/src/seed.ts` —
   - Meetings: `#0B1E3F` → `#22c55e` (green).
   - Notifications: `#8b5cf6` → `#06b6d4` (cyan) — kills the last
     purple in the default palette per user direction.

4. `scripts/src/update-app-colors.ts` (new) — idempotent migration
   that bumps existing rows ONLY when they still hold the exact old
   default colour, so admin customisations from the Apps editor are
   preserved. Wired into `scripts/package.json` as
   `pnpm run update-app-colors`.

5. `scripts/redeploy.sh` — new step 5/6 runs the colour migration
   after seed and before `docker compose up -d`, on the same one-shot
   `migrate` container pattern as other one-shot scripts.

No schema changes, no new deps. tx-os tsc passes, scripts tsc passes.
After `./scripts/redeploy.sh` on Mac, home shows four distinct hues
(yellow / orange / green / red) and no tile is purple anywhere.

scripts/redeploy.sh

@@ -72,13 +72,13 @@ fi
 step() { echo; echo "==> $*"; }
 
 if [ "$PULL" -eq 1 ]; then
-  step "1/4  git pull"
+  step "1/6  git pull"
   git pull --ff-only
 else
-  step "1/4  git pull (skipped via --no-pull)"
+  step "1/6  git pull (skipped via --no-pull)"
 fi
 
-step "2/5  docker compose build api web  (rebuilds SPA + API images)"
+step "2/6  docker compose build api web  (rebuilds SPA + API images)"
 # Stamp the API image with the current git SHA + UTC build time so the
 # admin "System Updates" panel shows visible proof that the new image
 # is actually running (instead of the old, hand-edited version.json).
@@ -88,14 +88,23 @@ export BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 echo "[redeploy]   GIT_SHA=$GIT_SHA  BUILD_DATE=$BUILD_DATE"
 "${DC[@]}" build api web
 
-step "3/5  docker compose run --rm migrate  (schema push + tolerant seed)"
+step "3/6  docker compose run --rm migrate  (schema push + tolerant seed)"
 "${DC[@]}" run --rm migrate
 
-step "4/5  explicit seed pass (fails hard on seed regressions)"
+step "4/6  explicit seed pass (fails hard on seed regressions)"
 "${DC[@]}" run --rm --no-deps --entrypoint "" migrate \
   pnpm --filter @workspace/scripts run seed
 
-step "5/5  docker compose up -d  (restart with the new images)"
+step "5/6  one-shot data migrations (idempotent)"
+# #603: bump seeded app tile colours on existing installs. The seed
+# step above uses onConflictDoNothing for `slug`, so already-seeded
+# rows keep their old colours forever without this. The script only
+# touches rows that still hold the OLD default — admin customisations
+# from the Apps editor are left alone.
+"${DC[@]}" run --rm --no-deps --entrypoint "" migrate \
+  pnpm --filter @workspace/scripts run update-app-colors
+
+step "6/6  docker compose up -d  (restart with the new images)"
 "${DC[@]}" up -d
 
 echo