fix(web): modal first-click, card order, cache hint

Three dashboard polish fixes:

- `showModal()` was called straight from the htmx response handler, outside
  the user's own click, so the first click on the dialog's Confirm button was
  swallowed while the top-layer/focus handoff settled. Defer it one animation
  frame and focus Confirm, so a single click confirms.
- Reorder the grid so infrastructure health (Host/VMware/Runners/Cache) reads
  before the VM table instead of after it.
- Drop the Maintenance purge-semantics hint duplicated in the Cargo cache
  card; it already sits next to the buttons it describes.

src/ci_orchestrator/web/static/app.js

@@ -99,7 +99,20 @@
       if (dialog.open) {
         dialog.close();
       }
-      dialog.showModal();
+      // showModal() is called here from an htmx response handler, not
+      // synchronously inside the user's own click -- some browsers then
+      // swallow the very first click on the dialog's contents (the
+      // top-layer promotion/focus handoff hasn't settled), so Confirm
+      // silently does nothing until clicked a second time. One animation
+      // frame is enough for that to settle; explicitly focusing Confirm
+      // afterwards makes the browser's hit-testing land on the button.
+      requestAnimationFrame(function () {
+        dialog.showModal();
+        var confirmBtn = dialog.querySelector('button[type="submit"]');
+        if (confirmBtn) {
+          confirmBtn.focus();
+        }
+      });
     }
     var cancel = dialog.querySelector("[data-modal-cancel]");
     if (cancel) {

src/ci_orchestrator/web/templates/dashboard.html

@@ -6,21 +6,21 @@
 {{ super() }}
 {% include "partials/status_header.html" %}
 {#
-  Layout ordering (Stage E). Narrative top-to-bottom: what's running now
-  (VMs) -> infrastructure health -> assets (templates + their backups) ->
-  build outputs (artifacts) -> managed services -> the dedicated
-  Maintenance/danger card last. The wide, many-column tables (vms / templates
-  / files / services / maintenance) span the full grid row via ``.card--wide``;
-  the four compact info cards flow in one breathing-room row between the VMs
-  table and the Templates table, ordered Host -> VMware -> Runners -> Cargo
-  cache.
+  Layout ordering (Stage E). Narrative top-to-bottom: infrastructure health ->
+  what's running now (VMs) -> assets (templates + their backups) -> build
+  outputs (artifacts) -> managed services -> the dedicated Maintenance/danger
+  card last. The wide, many-column tables (vms / templates / files / services
+  / maintenance) span the full grid row via ``.card--wide``; the four compact
+  info cards flow in one breathing-room row at the top, ordered Host ->
+  VMware -> Runners -> Cargo cache, followed by the VMs table and then the
+  Templates table.
 #}
 <div class="dashboard-grid">
-  {% include "partials/vms.html" %}
   {% include "partials/host.html" %}{# Host (CPU/RAM/load) #}
   {% include "partials/vmware.html" %}{# VMware modules #}
   {% include "partials/runners.html" %}{# Runners #}
   {% include "partials/cache.html" %}{# Cargo cache #}
+  {% include "partials/vms.html" %}
   {% include "partials/templates.html" %}
   {% include "partials/files.html" %}
   {% include "partials/services.html" %}

src/ci_orchestrator/web/templates/partials/cache.html

@@ -11,10 +11,6 @@
     <dd>{{ cache.oldest_age_days ~ " day(s)" if cache.oldest_age_days is not none else "-" }}</dd>
     <dt>Retention</dt><dd>{{ cache.retention_days }} day(s)</dd>
   </dl>
-  <p class="field-hint">
-    “Purge (max age)” in Maintenance removes only entries older than this
-    retention window; “Empty all” clears the cache regardless of age.
-  </p>
   {% else %}
   <p class="notice notice-warn" role="alert">Cargo cache status unavailable.</p>
   {% endif %}