feat(web): dark Gitea UI, systemd installer, WEB-UI docs (W7)

Restyles every template with a hand-written dark Gitea-style theme
(web/static/app.css, ~270 lines: badges, buttons, cards, focus rings,
prefers-reduced-motion) and completes the htmx polling wiring for all
four dashboard cards. Adds the repeatable setup-web-linux.sh installer
(idempotent: pip install '[web]' non-editable, render ci-web.service,
template [web]/[web.oidc] into config.toml, prompt for keyring secrets,
print Gitea OIDC registration steps, enable/restart the unit) plus
deploy/systemd/ci-web.service and docs/WEB-UI.md.

deploy/systemd/ci-web.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=Local CI/CD — web dashboard (ci web serve)
+Documentation=file:///opt/ci/local-ci-cd-system/docs/WEB-UI.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ci-runner
+Group=ci-runner
+WorkingDirectory=/opt/ci/local-ci-cd-system
+# CI_CONFIG (and any other CI_* override) lives here, one KEY=VALUE per
+# line, no quoting. The "-" prefix means the unit still starts if the file
+# is absent (config.toml is then auto-discovered at /var/lib/ci/config.toml
+# — see config.py's resolution order). Rendered/edited by setup-web-linux.sh
+# — never put secrets in this file, only the config path.
+EnvironmentFile=-/etc/ci/web.env
+# The bind address below is filled in by setup-web-linux.sh at install time
+# (a LAN IP, or left as 127.0.0.1 for loopback-only) — never edit this file
+# by hand on the target host, re-run the installer instead.
+ExecStart=/opt/ci/venv/bin/python -m ci_orchestrator web serve --host __CI_WEB_BIND_HOST__ --port 8800
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=30s
+
+# Hardening. ProtectHome=read-only (NOT "yes"/true): the OIDC/session
+# secrets are read from ci-runner's headless keyring backend
+# (keyrings.alt.file.PlaintextKeyring, ~/.local/share/python_keyring/ —
+# see docs/WEB-UI.md's keyring-headless note); "yes" would hide /home
+# entirely and every login would fail with a keyring lookup error.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=true
+ReadWritePaths=/var/lib/ci
+
+[Install]
+WantedBy=multi-user.target