feat(dashboard): unified design system + persistent per-app tab bar

Addresses two interrelated UX complaints:

1. Browser-default controls leaking through the dark theme
   (native <select> chevrons, OS checkbox/radio look, date-picker
   icons, <details> triangle marker, number input spinners).
2. Subroute pages dropping the main app's tab bar in favor of a back
   link, breaking navigation continuity across users/files/queues/
   dead-letters/queues-[name].

Design tokens (dashboard/src/routes/+layout.svelte):

- Token vocabulary expanded with 18 new variables covering
  text-strong, accent + accent-fg, danger/success/warning bg/fg/border
  triplets, bg-elevated-hover, radii (sm/md/lg/pill), shadow-elev-2,
  and z scale (popover/modal/toast). 7 alias tokens (--muted,
  --link, --text, --color-error, --color-border, --chip-bg,
  --code-bg) absorb the orphan references the F-U-004 remediation
  partially renamed.
- Global :global(...) resets for <select>, <input type='checkbox'>,
  <input type='radio'>, <input type='number'>, <input type='date'>,
  and <details>/<summary> ensure native controls track the dark
  palette out of the box. No per-page edits needed.

Tab consistency:

- New dashboard/src/lib/AppTabBar.svelte renders all 11 per-app
  tabs (Scripts, Domains, Members, Triggers, Topics, Secrets,
  Settings, Users, Files, Queues, Dead letters) as <a> links with
  an active highlight derived from the URL. Tabs that switch
  in-page panels go to ?tab=<id>; tabs that switch routes go to
  the subroute. Admin-only tabs are hidden when canAdmin is false.
- New dashboard/src/routes/apps/[slug]/+layout.svelte loads the
  app once, handles the historical-slug redirect, exposes the
  shared app + canAdmin + canWrite + dead-letter-count state via
  Svelte context, and renders the breadcrumb + AppTabBar above
  every per-app page. The 5 subroute pages drop their own "← back"
  headers since the layout owns them now.
- apps/[slug]/+page.svelte's local-state activeTab becomes URL-
  driven via $page.url.searchParams.get('tab'). Defense-in-depth
  redirect for non-admin viewers landing on admin-only tabs uses
  goto({replaceState:true}) instead of mutating state.

Light-theme leftovers swept on 5 subroute pages:

- dead-letters: error banner, badge, pre/code blocks all swap to
  --color-danger-*, --bg-elevated, --text-primary
- files: button.danger, var(--muted,#666) → token-only
- queues + queues/[name]: bare hex fallbacks removed; .toolbar and
  .auto-refresh styled with tokens; data-testid for the queues
  empty state (already added by previous commit, reaffirmed here)
- users + users/invitations: badge-ok/badge-pending now use
  --color-success-bg/fg and --color-warning-bg/fg; chips use
  --bg-elevated + --text-strong; .create-form gets a token-styled
  surface; row-action buttons gain explicit dark-theme styling

E2E selector updates:

- members.spec.ts, integration.spec.ts, apps.spec.ts — the tab bar
  is now <a> elements (role=link) without a count suffix. Test
  selectors swap from getByRole('button', name: /^Scripts \(\d+\)$/)
  to getByRole('link', { name: 'Scripts' }), etc.
- New navigation/tabs.spec.ts still passes; existing 60+ tests
  unchanged except for the selector swap. Two pre-existing failures
  (routing.spec.ts:79, integration.spec.ts:89) untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/src/routes/apps/[slug]/files/+page.svelte

@@ -114,11 +114,10 @@
 	<title>Files · {slug} · PiCloud</title>
 </svelte:head>
 
-<div class="container">
-	<header>
+<div class="panel">
+	<header class="panel-head">
 		<div>
-			<a href="{base}/apps/{slug}" class="back">&larr; back to {app?.name ?? slug}</a>
-			<h1>Files</h1>
+			<h2>Files</h2>
 			<p class="subtitle">
 				Browse and delete stored blobs by collection. Uploads happen from scripts via
 				<code>files::collection(c).create(…)</code>.
@@ -246,19 +245,15 @@
 {/if}
 
 <style>
-	.container {
-		max-width: 60rem;
-		margin: 0 auto;
-		padding: 1.5rem;
-	}
-	header {
+	.panel-head {
 		margin-bottom: 1rem;
 	}
-	.back {
-		font-size: 0.85rem;
+	.panel-head h2 {
+		margin: 0.25rem 0;
+		font-size: 1.125rem;
 	}
 	.subtitle {
-		color: var(--muted, #666);
+		color: var(--text-muted);
 		font-size: 0.9rem;
 	}
 	.collection-form {
@@ -282,7 +277,7 @@
 	td {
 		text-align: left;
 		padding: 0.4rem 0.6rem;
-		border-bottom: 1px solid var(--border, #e2e2e2);
+		border-bottom: 1px solid var(--border);
 	}
 	.mono {
 		font-family: monospace;
@@ -316,6 +311,8 @@
 		margin: 0.5rem 0;
 	}
 	button.danger {
-		color: #b00020;
+		background: var(--color-danger-bg);
+		color: var(--color-danger-fg);
+		border: 1px solid var(--color-danger-border);
 	}
 </style>