feat(web): rebuild the page chrome around one layout (spec 0015)

[nofuturekid]

Implements spec 0015.

What was wrong

Four structural defects, all reproducible with real data at a normal desktop width:

1. Three competing content widths — main 60rem, .card 24rem, .card-wide 48rem. Settings and the dashboard rendered at half the width of every table page, and the 60rem of main was never used.
2. Tables had no overflow container — table { width: 100% } without a fixed layout grows past its card. /certs drew its last three columns 275px outside the card and off the screen; /users 221px, /ca 63px.
3. No wrapping rule for unbreakable strings — serials, EAB key ids and base URLs were painted through their container's border; ISO timestamps broke across four lines.
4. Nothing was responsive — no flex-wrap on the nav or the filter rows, no media query anywhere. Below ~60rem the page scrolled sideways.

Two further problems came from the same stylesheet: form { display: flex; flex-direction: column } stretched every button to the full card width, and because settings and ACME are one <form> each, their headings and prose were flex items with the same 0.5rem gap as the input fields.

What changed

Pages now compose from a grouped navigation rail plus a content column that uses the window, and from four primitives:

• .scroller — the only element allowed to scroll horizontally
• .section — a heading and its explanation beside its controls
• .field / .actions — form is no longer a layout, so a button is sized by its text
• .tag — replaces .badge-*, keeping the value in the class name (tag-valid, tag-source-acme) so a value can still be styled and asserted on

Both colour schemes are complete, the rail collapses to a wrapping nav strip below 60rem, and the current page carries aria-current="page". Two SIL OFL fonts are vendored with their licences (Public Sans + IBM Plex Mono, 57 KB of woff2) — nothing is fetched from a CDN.

No routes, permissions, CSRF behaviour, data or page copy changed.

Verification

tests/test_web_layout.py renders all ten authenticated pages in headless Chrome with a 60-character common name and five SANs, and measures every element against the viewport and against its own container at 1440×1150 and 390×900. Both widths: zero offenders.

The probe is checked for sensitivity rather than assumed: run against the pre-0015 templates it reports /certs +275px, /users +221px and /ca +63px out of container, and it turns red if .scroller stops scrolling. An earlier scrollWidth-based version of the same test called the known-broken pages clean and was discarded.

make check: 473 passed, no skips.

Notes

• Five assertions in test_web_certs_inventory, test_web_acme_ui and test_mcp were renamed from badge-* to tag-*. Their intent is unchanged.
• One real regression was caught by the existing suite and fixed: moving the pager into the {% if certs %} branch removed the way back from an out-of-range page number. test_list_page_absurd_page_is_empty_not_an_error failed; the pager now sits outside the branch in both certs_list.html and audit.html.