D0 Part 4: settings visual pass + remaining pages; grep gate zero

- settings.html: Aktív/Inaktív rows -> run-blue check / neutral gray
  (Inaktív no longer red), update states -> run/crit/progress with
  sprite check/x/spinner, pencil + cancel buttons -> icons, storage
  badges -> tags, host-disk bar + JS drive capBar -> meters
  (usageColorClass -> nominal/warn/crit), state-text-* consumers on the
  new suffixes incl. JS-built class names.
- debug.html, app_info.html, storage_init/attach.html, logs.html:
  emoji -> sprite icons or plain text in templates AND JS strings.
- catchall.html (standalone, no sprite): v2 token sweep of its inline
  style, status emoji -> inline SVGs; a stopped app renders neutral,
  not red.
- login.html: two-tone H1 (last word blue-bright).
- setup_hub_versions.html: stale var(--border,#30363d) fallback -> v2.
- Test Group F grep gate: all 34 banned patterns at ZERO across
  internal/web + internal/setup; Scenario E test now asserts the
  '--bg-0: #0A1220' token literal.

controller/internal/setup/css_test.go

@@ -35,6 +35,9 @@ func TestSetupCSSServesEmbedded(t *testing.T) {
 	if len(body) <= 10000 {
 		t.Fatalf("body length = %d, want > 10000 (minimalCSS fallback served?)", len(body))
 	}
+	if !strings.Contains(string(body), "--bg-0: #0A1220") {
+		t.Error("served CSS is missing the v2 token block (--bg-0)")
+	}
 	embedded, err := web.StyleCSS()
 	if err != nil {
 		t.Fatalf("web.StyleCSS() error: %v", err)

controller/internal/setup/templates/setup_hub_versions.html

@@ -31,7 +31,7 @@
                     </thead>
                     <tbody>
                     {{range $i, $v := .Versions}}
-                        <tr style="border-top: 1px solid var(--border, #30363d);">
+                        <tr style="border-top: 1px solid var(--line);">
                             <td style="padding: 0.5rem;">
                                 <input type="radio" name="version_id" value="{{$v.ID}}" {{if eq $i 0}}checked{{end}}>
                             </td>