ui: validity indicator rendering + warning theme colour (ADR-0027 step D)

Adds the `[ERR]` / `[WRN]` validity indicator to the input
row. `App` gains `input_indicator: Option<Severity>` (the
runtime owns its timing — step E) and a pure
`input_validity_verdict()` query that runs `input_verdict`
in simple mode only (advanced mode is raw SQL, ADR-0027 §7).

`render_input_panel` reserves the rightmost six columns of
the input row unconditionally (ADR-0027 §4) — a five-column
label plus a one-column gap — so the typed command never
shifts sideways when the indicator appears or hides. The
label renders only when `input_indicator` is set: `[ERR]` in
`theme.error`, `[WRN]` in the new amber `theme.warning`
(defined for both light and dark themes).

The indicator is not yet wired live — `input_indicator`
stays `None` until the debounce lands (step E). Covered by a
render test and the theme contrast test; the input-panel
snapshot is updated for the six-column reservation.

src/app.rs

@@ -71,6 +71,13 @@ pub struct App {
     pub input_cursor: usize,
     pub output: VecDeque<OutputLine>,
     pub hint: Option<String>,
+    /// The validity indicator's currently-visible verdict
+    /// (ADR-0027). `None` means the indicator shows nothing —
+    /// the input is clean, or it is hidden mid-typing while the
+    /// debounce settles. The runtime owns the timing: it clears
+    /// this on a keystroke and sets it from
+    /// [`App::input_validity_verdict`] once typing pauses.
+    pub input_indicator: Option<crate::dsl::walker::Severity>,
     pub tables: Vec<String>,
     /// Last successfully described table, shown in the output
     /// pane until the next DDL operation.
@@ -235,6 +242,7 @@ impl App {
             input_cursor: 0,
             output: VecDeque::with_capacity(OUTPUT_CAPACITY),
             hint: None,
+            input_indicator: None,
             tables: Vec::new(),
             current_table: None,
             history: Vec::new(),
@@ -304,6 +312,21 @@ impl App {
         }
     }
 
+    /// The validity-indicator verdict for the current input
+    /// (ADR-0027 §3). `None` when the input would run clean.
+    ///
+    /// Computed only in simple mode — advanced mode is raw SQL,
+    /// which the DSL walker does not parse (ADR-0027 §7). A
+    /// pure query the runtime calls once the typing debounce
+    /// settles; the result is stored in `input_indicator`.
+    #[must_use]
+    pub fn input_validity_verdict(&self) -> Option<crate::dsl::walker::Severity> {
+        if !matches!(self.effective_mode(), EffectiveMode::Simple) {
+            return None;
+        }
+        crate::dsl::walker::input_verdict(&self.input, Some(&self.schema_cache))
+    }
+
     /// Process one event from the runtime, mutating state and
     /// returning any actions for the runtime to enact.
     pub fn update(&mut self, event: AppEvent) -> Vec<Action> {