feat(web): Stage E dashboard — wide cards, per-item actions, toast stack

A large, cohesive redesign of the web dashboard (all pieces depend on
each other, so this lands as one commit):

Layout / display:
- Host/Runners/VMware/Cache split into a Host-VMware-Runners-Cache info
  row; Host card keeps uptime/load/cores/mem-total now that CPU%/RAM
  are promoted to the status-header tiles (new gauge tiles, red/amber/
  green thresholds shared with the existing disk tile).
- VMware modules rendered as a table; Live VMs/Templates/Artifacts/
  Services/Maintenance span the full grid width (card--wide).
- Backups moved from a standalone Files-panel table into an expandable
  per-template row on the Templates panel (backups_by_template), with
  a per-backup Delete action and a per-row Backup button replacing the
  old host-card template dropdown.
- New Maintenance card: cleanup-orphans and cache-purge forms
  consolidated into one danger-zone card (red rule + row separators),
  each op's max-age control on its own row so it reads as the op's
  parameter, not decoration; cache purge gets an explicit "Empty all"
  button alongside the age-based "Purge".
- Artifacts gain a per-row Delete action.

Action/feedback layer:
- Every mutating route now sets HX-Trigger: ci:refresh on its result,
  so polled panels reload immediately instead of waiting for their
  next poll interval; _result_partial takes an explicit level
  (ok/info/error) independent of the ok bool, so e.g. an age-based
  purge that finds nothing to remove reads as neutral "info" instead
  of a misleading green "ok" or a red "error".
- Results render as toasts appended to a fixed #toast-stack (base.html)
  instead of swapping a single #action-slot -- concurrent actions (two
  backups running at once) now each keep their own toast instead of
  the later one clobbering the earlier. Per-state colour is a left
  stripe + tint (result-ok/info/error), fixing a cascade bug where the
  plain .toast background silently beat the state class.
- The confirm dialog is a real modal <dialog> (app.js: showModal(),
  Cancel/ESC clear the slot); confirming closes it immediately and
  shows a busy spinner toast in the stack (since a real backup can run
  for minutes) instead of leaving the dialog open with no feedback.
- host_backup now runs backup_template via asyncio.to_thread so a
  multi-GB 7z run no longer blocks the event loop (and every other
  dashboard poll) for its whole duration.
- Static assets are served with a mtime-based ?v= query param so a
  redeploy is picked up without a hard refresh.

tests/python/test_web_theming.py

@@ -55,7 +55,7 @@ def _csrf_from(text: str) -> str:
 def test_hx_request_preview_gets_bare_partial(tmp_path: Path) -> None:
     app = create_app(_make_config(tmp_path))
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post(
         "/cache/purge", data={"csrf": csrf}, headers={"HX-Request": "true"}
@@ -70,7 +70,7 @@ def test_hx_request_preview_gets_bare_partial(tmp_path: Path) -> None:
 def test_hx_request_execute_gets_bare_partial(tmp_path: Path) -> None:
     app = create_app(_make_config(tmp_path))
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post(
         "/cache/purge",
@@ -89,12 +89,12 @@ def test_hx_request_execute_gets_bare_partial(tmp_path: Path) -> None:
 def test_no_hx_header_preview_gets_full_themed_page(tmp_path: Path) -> None:
     app = create_app(_make_config(tmp_path))
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post("/cache/purge", data={"csrf": csrf})
 
     assert resp.status_code == 200
-    assert '<link rel="stylesheet" href="/static/app.css">' in resp.text
+    assert '<link rel="stylesheet" href="/static/app.css?v=' in resp.text
     assert 'id="action-slot"' in resp.text
     assert "Confirm" in resp.text
 
@@ -102,7 +102,7 @@ def test_no_hx_header_preview_gets_full_themed_page(tmp_path: Path) -> None:
 def test_no_hx_header_execute_gets_full_themed_page(tmp_path: Path) -> None:
     app = create_app(_make_config(tmp_path))
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post("/cache/purge", data={"csrf": csrf, "stage": "execute"})
 
@@ -123,7 +123,7 @@ def test_lock_conflict_status_code_preserved_in_full_page(tmp_path: Path) -> Non
     app = create_app(config)
     app.dependency_overrides[get_backend] = lambda: None
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post("/vms/cleanup", data={"csrf": csrf, "stage": "execute"})
 
@@ -141,7 +141,7 @@ def test_lock_conflict_status_code_preserved_bare_for_htmx(tmp_path: Path) -> No
     app = create_app(config)
     app.dependency_overrides[get_backend] = lambda: None
     client = TestClient(app)
-    csrf = _csrf_from(client.get("/cache").text)
+    csrf = _csrf_from(client.get("/").text)
 
     resp = client.post(
         "/vms/cleanup",