v0.319.0: the app page in panels, the login in one place, a password the box never had is said in words

- style A (operator 2026-10-16): hero, tab bar and every section are panels on --bg-1, one width, 16px apart;
  the install page's form groups use the same rule; the settings tab's 700px inner wrapper is gone
- „Belépés az alkalmazásba": name + password side by side, fetched on demand (R-254, R-709); pairing in app_login.go
- the empty-value rule: no stored value -> a sentence, never an eye; page and reveal endpoint share storedValuePresent
- „Cím és kulcsok" is rows (no Domain input, no disabled storage select, no install form); hint under the title
- tests red-proved: app_page_tuning_test.go (4); 36 app-page parity fixtures re-captured, 4 new; install fixtures unchanged

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/web/templates/app_fields.html

@@ -1,9 +1,11 @@
-{{/* THE APP'S CONFIGURATION FIELDS — shared by the install wizard and the settings tab.
+{{/* THE APP'S CONFIGURATION FIELDS — the install wizard's form (deploy.html).
 
-     ONE copy of this markup, rendered by two surfaces, because they are the same fields: the
-     install page submits them, the settings tab shows what was submitted. `.AlreadyDeployed` is
-     the single flag every branch below reads, exactly as it did when both surfaces were one page —
-     that is what keeps the install form and the settings view from drifting apart.
+     v0.319.0: the settings tab no longer renders this — it shows the install answers as rows and
+     the login as one panel (app_settings.html, app_login.go). The `.AlreadyDeployed` branches below
+     are NOT dead: `/apps/{slug}/install` still answers for an app that is installed, and renders
+     this form read-only. Their guards are what keep an installed app's secrets out of that page
+     (TestDeployPage_DeployedApp_DoesNotCarryTheSecret, TestR709_AnInstalledAppsPasswordIsNotInThePage)
+     and the parity case `deploy_installed` renders them.
 
      The secret rules are unchanged and load-bearing:
        R-254 — an INSTALLED app's `type: secret` value is not in the page; the eye fetches it.