Color picker: shared links don't restore the selected color

## What happens

The picker encodes color spaces in the URL (e.g. `/picker/oklch+p3`) but never the color value. Sharing a link always opens the default color `lch(50 50 50)` for the recipient, regardless of what you had selected.

## Steps to reproduce

1. Open the color picker and select any color, e.g. `oklch(72% 0.18 142)`
2. Copy the URL it shows `/picker/oklch`, no color value
3. Open it in a private window (no shared localStorage)
4. Picker opens with `lch(50 50 50)` your color is lost
## Root cause

`updateLocation()` only writes spaces to the URL, never the color. The color goes to `localStorage` only which is per-device and not shareable.

The comment in `index.js` even says:

```js
// The URL encodes every picker's color space (e.g. /picker/oklch+p3) so
// the whole picker configuration can be restored on load.
```

"Whole configuration" is misleading only the spaces are restored, not the color.

## Why the fix isn't trivial

Naively calling `pushState` on every color change (every slider tick) would spam browser history dragging lightness from 50→72 creates ~22 history entries and breaks the Back button.

The fix needs two strategies:

- `pushState` for structural changes (add/remove picker, space change) intentional navigation
- `replaceState` for color changes updates the URL bar in place, no history entry
## Expected

`/picker/oklch?color=oklch(72%25%200.18%20142)` should open in oklch with that exact color, regardless of the recipient's localStorage.

Start in index.js at updateLocation() and the picker URL-loading logic. Trace how color spaces are serialized and how the selected color is currently persisted in localStorage. Restore the color from a shared URL, use replacement navigation for color changes and push navigation for structural changes, and verify that a private-window link opens with the encoded color without adding history entries for slider ticks.

Written by the indexing model from the issue text.