D0 Part 4: settings visual pass + remaining pages; grep gate zero

- settings.html: Aktív/Inaktív rows -> run-blue check / neutral gray
  (Inaktív no longer red), update states -> run/crit/progress with
  sprite check/x/spinner, pencil + cancel buttons -> icons, storage
  badges -> tags, host-disk bar + JS drive capBar -> meters
  (usageColorClass -> nominal/warn/crit), state-text-* consumers on the
  new suffixes incl. JS-built class names.
- debug.html, app_info.html, storage_init/attach.html, logs.html:
  emoji -> sprite icons or plain text in templates AND JS strings.
- catchall.html (standalone, no sprite): v2 token sweep of its inline
  style, status emoji -> inline SVGs; a stopped app renders neutral,
  not red.
- login.html: two-tone H1 (last word blue-bright).
- setup_hub_versions.html: stale var(--border,#30363d) fallback -> v2.
- Test Group F grep gate: all 34 banned patterns at ZERO across
  internal/web + internal/setup; Scenario E test now asserts the
  '--bg-0: #0A1220' token literal.

controller/internal/web/templates/style.css

@@ -3234,3 +3234,13 @@ span.mono, .mono { font-family: var(--font-data); }
 .ico-spin { animation: ico-spin 1s linear infinite; }
 @keyframes ico-spin { to { transform: rotate(360deg); } }
 @media (prefers-reduced-motion: reduce) { .ico-spin { animation: none; } }
+
+/* Login page — two-tone heading (H1 last word in blue-bright) */
+.login-title {
+    font-size: 1.35rem;
+    font-weight: 700;
+    margin-bottom: .25rem;
+}
+.login-title .title-accent {
+    color: var(--blue-bright);
+}