feat(web): dark Gitea UI, systemd installer, WEB-UI docs (W7)

Restyles every template with a hand-written dark Gitea-style theme
(web/static/app.css, ~270 lines: badges, buttons, cards, focus rings,
prefers-reduced-motion) and completes the htmx polling wiring for all
four dashboard cards. Adds the repeatable setup-web-linux.sh installer
(idempotent: pip install '[web]' non-editable, render ci-web.service,
template [web]/[web.oidc] into config.toml, prompt for keyring secrets,
print Gitea OIDC registration steps, enable/restart the unit) plus
deploy/systemd/ci-web.service and docs/WEB-UI.md.

src/ci_orchestrator/web/templates/partials/cache.html

@@ -1,4 +1,4 @@
-<div id="cache-partial">
+<section class="card" id="cache-card" hx-get="/cache" hx-trigger="every 5s" hx-swap="outerHTML">
   <h2>Cargo cache</h2>
   {% if cache %}
   <dl>
@@ -10,10 +10,10 @@
     <dt>Retention</dt><dd>{{ cache.retention_days }} day(s)</dd>
   </dl>
   {% else %}
-  <p class="notice notice-warn">Cargo cache status unavailable.</p>
+  <p class="notice notice-warn" role="alert">Cargo cache status unavailable.</p>
   {% endif %}
-  <form method="post" action="/cache/purge" id="cache-purge-form">
+  <form method="post" action="/cache/purge" id="cache-purge-form" aria-label="Purge cargo cache">
     <input type="hidden" name="csrf" value="{{ csrf_token }}">
-    <button type="submit" class="btn btn-danger">Purge cache</button>
+    <button type="submit" class="btn btn-danger" aria-label="Purge cargo cache">Purge cache</button>
   </form>
-</div>
+</section>