feat(web): dashboard redesign — Gitea palette, health panels, VM/audit enrichment (stages A–C)

Stage A: swap CSS tokens to the real Gitea dark palette (accent blue #4183c4); add Jinja formatting filters (humanbytes/duration/relative_time/localtime/shorten_path/thousands), a health status-header, and an inline SVG icon sprite; fix two UI bugs — unthemed action pages (htmx swap into #action-slot with a full-page HX-Request fallback) and polling wiping form input (hx-preserve).

Stage B: four read-only panels that degrade to notices (never 500) — host resources (/proc, two-sample CPU%), VMware module health, template inventory (.vmem warn + last backup), and a path-contained file browser; backup card becomes a validated template dropdown; expensive dir-size walk is TTL-cached. Adds operations/inventory.py plus host_resources()/vmware_module_health() in operations/host.py.

Stage C: parse_clone_name() adds a Job column (job_id + started) to the VM table; nav gains a Gitea link-out derived from the OIDC issuer origin (no fabricated run URLs); audit page gets action icons, relative time, and a client-side filter.

Gates: 989 tests pass, coverage 94.12%, ruff + mypy --strict clean. Stage D (service management) intentionally deferred.

tests/python/test_config_web.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 
 from pathlib import Path
 
-from ci_orchestrator.config import WebConfig, WebOidcConfig, load_config
+from ci_orchestrator.config import WebConfig, WebOidcConfig, gitea_base_url, load_config
 
 
 def _paths_section() -> str:
@@ -182,3 +182,72 @@ def test_toml_secret_looking_value_is_never_surfaced_as_a_secret(tmp_path: Path)
     # No attribute on WebOidcConfig can ever hold "should-never-be-read".
     for value in vars(cfg.web.oidc).values():
         assert value != "should-never-be-read"
+
+
+# ── [web].gitea_url (Stage C2) ───────────────────────────────────────────────
+
+
+def test_gitea_url_absent_from_toml_defaults_to_none() -> None:
+    assert WebConfig().gitea_url is None
+
+
+def test_gitea_url_explicit_toml_value_populates_field(tmp_path: Path) -> None:
+    extra = '\n[web]\ngitea_url = "https://gitea.example.lan"\n'
+    cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
+
+    assert cfg.web.gitea_url == "https://gitea.example.lan"
+
+
+def test_gitea_base_url_explicit_override_wins_over_issuer(tmp_path: Path) -> None:
+    extra = (
+        "\n[web]\n"
+        'gitea_url = "https://gitea.explicit.lan"\n'
+        "\n[web.oidc]\n"
+        'issuer = "https://gitea.emulab.it"\n'
+        'client_id = "ci-web"\n'
+        'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
+    )
+    cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
+
+    assert gitea_base_url(cfg.web) == "https://gitea.explicit.lan"
+
+
+def test_gitea_base_url_derives_origin_from_oidc_issuer(tmp_path: Path) -> None:
+    extra = (
+        "\n[web.oidc]\n"
+        'issuer = "https://gitea.emulab.it"\n'
+        'client_id = "ci-web"\n'
+        'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
+    )
+    cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
+
+    assert cfg.web.gitea_url is None  # not set explicitly
+    assert gitea_base_url(cfg.web) == "https://gitea.emulab.it"
+
+
+def test_gitea_base_url_strips_issuer_path_and_query() -> None:
+    web = WebConfig(
+        oidc=WebOidcConfig(
+            issuer="https://gitea.emulab.it/some/path?query=1",
+            client_id="ci-web",
+            redirect_url="http://127.0.0.1:8800/auth/callback",
+        )
+    )
+
+    assert gitea_base_url(web) == "https://gitea.emulab.it"
+
+
+def test_gitea_base_url_none_when_oidc_unset_and_no_explicit_url() -> None:
+    assert gitea_base_url(WebConfig()) is None
+
+
+def test_gitea_base_url_none_when_issuer_unparseable() -> None:
+    web = WebConfig(
+        oidc=WebOidcConfig(
+            issuer="not-a-url",
+            client_id="ci-web",
+            redirect_url="http://127.0.0.1:8800/auth/callback",
+        )
+    )
+
+    assert gitea_base_url(web) is None