Extract CSS/JS to static files, wrap header pills, add version footer

The palette lived in a :root block duplicated across all three
templates, so every reshade meant three edits — and drifted twice in
practice (the favicon hardcoded its own hex; stale danger-border rgba
literals survived two palette changes). Move tokens to a single
static/css/base.css, derive every dim/border tint from the four source
hues with color-mix, and point the favicon at one static/favicon.svg.

Also splits the 1558-line dashboard.html into template + static assets:
662 lines of CSS and 396 of JS were re-sent uninlined on every load
with no browser caching, which costs real time on the remote/cellular
access this app is built for. Templates drop to 501/42/107 lines.
Server-rendered config (timezone, script_root) now arrives via
<body data-*>; wiring URL_BASE to request.script_root also fixes /api/*
fetches for a future subpath mount, which the hardcoded "" would break.

Header service pills now wrap instead of scrolling — they were clipped
at narrow widths, and a hidden pill is a service whose status you
cannot see. Verified 0 clipped and no page overflow at 320/375/700/1280.

Footer gains a version and date so the running build is identifiable
without trusting the Unraid Docker tab's cached container IDs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app.py

@@ -15,6 +15,14 @@ from flask import Flask, render_template, request, jsonify, redirect, url_for, s
 # Suppress SSL warnings for Unraid's self-signed certificate
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
+# Build identity, shown in the dashboard footer. Bump these when cutting a
+# deploy so the running container is identifiable at a glance — the Unraid
+# Docker tab caches stale container IDs, so the footer is the reliable way
+# to confirm a `docker compose up -d --build` actually took effect.
+# Both are env-overridable if the deploy pipeline ever injects them.
+APP_VERSION = os.environ.get("APP_VERSION", "1.1.0")
+APP_VERSION_DATE = os.environ.get("APP_VERSION_DATE", "2026-08-26")
+
 # Must point at a path that survives `docker compose up --build` — the
 # container filesystem does not. See the data volume in docker-compose.yml.
 SETTINGS_FILE = os.environ.get(
@@ -116,6 +124,12 @@ app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1)
 if _script_name:
     app.wsgi_app = ScriptNameMiddleware(app.wsgi_app, _script_name)
 
+
+@app.context_processor
+def inject_version():
+    """Make the build identity available to every template."""
+    return {"app_version": APP_VERSION, "app_version_date": APP_VERSION_DATE}
+
 # ── Authentication ──────────────────────────────────────────────────────────
 LOGIN_PASSWORD = os.environ.get("LOGIN_PASSWORD", "")
 _runtime_password = None  # overrides env var after change-password call