feat(dashboard): unified design system + persistent per-app tab bar

Addresses two interrelated UX complaints:

1. Browser-default controls leaking through the dark theme
   (native <select> chevrons, OS checkbox/radio look, date-picker
   icons, <details> triangle marker, number input spinners).
2. Subroute pages dropping the main app's tab bar in favor of a back
   link, breaking navigation continuity across users/files/queues/
   dead-letters/queues-[name].

Design tokens (dashboard/src/routes/+layout.svelte):

- Token vocabulary expanded with 18 new variables covering
  text-strong, accent + accent-fg, danger/success/warning bg/fg/border
  triplets, bg-elevated-hover, radii (sm/md/lg/pill), shadow-elev-2,
  and z scale (popover/modal/toast). 7 alias tokens (--muted,
  --link, --text, --color-error, --color-border, --chip-bg,
  --code-bg) absorb the orphan references the F-U-004 remediation
  partially renamed.
- Global :global(...) resets for <select>, <input type='checkbox'>,
  <input type='radio'>, <input type='number'>, <input type='date'>,
  and <details>/<summary> ensure native controls track the dark
  palette out of the box. No per-page edits needed.

Tab consistency:

- New dashboard/src/lib/AppTabBar.svelte renders all 11 per-app
  tabs (Scripts, Domains, Members, Triggers, Topics, Secrets,
  Settings, Users, Files, Queues, Dead letters) as <a> links with
  an active highlight derived from the URL. Tabs that switch
  in-page panels go to ?tab=<id>; tabs that switch routes go to
  the subroute. Admin-only tabs are hidden when canAdmin is false.
- New dashboard/src/routes/apps/[slug]/+layout.svelte loads the
  app once, handles the historical-slug redirect, exposes the
  shared app + canAdmin + canWrite + dead-letter-count state via
  Svelte context, and renders the breadcrumb + AppTabBar above
  every per-app page. The 5 subroute pages drop their own "← back"
  headers since the layout owns them now.
- apps/[slug]/+page.svelte's local-state activeTab becomes URL-
  driven via $page.url.searchParams.get('tab'). Defense-in-depth
  redirect for non-admin viewers landing on admin-only tabs uses
  goto({replaceState:true}) instead of mutating state.

Light-theme leftovers swept on 5 subroute pages:

- dead-letters: error banner, badge, pre/code blocks all swap to
  --color-danger-*, --bg-elevated, --text-primary
- files: button.danger, var(--muted,#666) → token-only
- queues + queues/[name]: bare hex fallbacks removed; .toolbar and
  .auto-refresh styled with tokens; data-testid for the queues
  empty state (already added by previous commit, reaffirmed here)
- users + users/invitations: badge-ok/badge-pending now use
  --color-success-bg/fg and --color-warning-bg/fg; chips use
  --bg-elevated + --text-strong; .create-form gets a token-styled
  surface; row-action buttons gain explicit dark-theme styling

E2E selector updates:

- members.spec.ts, integration.spec.ts, apps.spec.ts — the tab bar
  is now <a> elements (role=link) without a count suffix. Test
  selectors swap from getByRole('button', name: /^Scripts \(\d+\)$/)
  to getByRole('link', { name: 'Scripts' }), etc.
- New navigation/tabs.spec.ts still passes; existing 60+ tests
  unchanged except for the selector swap. Two pre-existing failures
  (routing.spec.ts:79, integration.spec.ts:89) untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/src/routes/apps/[slug]/queues/+page.svelte

@@ -72,16 +72,15 @@
 	<title>Queues — {app?.name ?? slug} — PiCloud</title>
 </svelte:head>
 
-<header>
-	<a class="back" href="{base}/apps/{slug}">← Back to {app?.name ?? slug}</a>
-	<h1>Queues</h1>
+<header class="panel-head">
+	<h2>Queues</h2>
 	<p class="subtle">
 		Per-app durable queues. Producers call <code>queue::enqueue(name, msg)</code>;
 		consumers register a <code>queue:receive</code> trigger. v1.1.9.
 	</p>
 	<!-- F-U-013: refresh + auto-refresh toggle. -->
 	<div class="toolbar">
-		<button type="button" onclick={() => loadQueues()} disabled={loading}>
+		<button type="button" class="secondary" onclick={() => loadQueues()} disabled={loading}>
 			{loading ? 'Refreshing…' : 'Refresh'}
 		</button>
 		<label class="auto-refresh">
@@ -137,25 +136,52 @@
 {/if}
 
 <style>
-	header {
+	.panel-head {
 		margin-bottom: 1rem;
 	}
-	.back {
-		font-size: 0.875rem;
-		color: var(--color-link);
-	}
-	h1 {
+	h2 {
 		margin: 0.25rem 0;
+		font-size: 1.125rem;
 	}
 	.subtle {
-		color: var(--color-muted);
+		color: var(--text-muted);
 		font-size: 0.875rem;
 	}
+	.toolbar {
+		display: flex;
+		gap: 0.75rem;
+		align-items: center;
+		margin-top: 0.75rem;
+	}
+	.auto-refresh {
+		display: inline-flex;
+		gap: 0.4rem;
+		align-items: center;
+		font-size: 0.875rem;
+		color: var(--text-muted);
+	}
+	button.secondary {
+		background: transparent;
+		color: var(--text-muted);
+		border: 1px solid var(--border);
+		padding: 0.4rem 0.85rem;
+		border-radius: var(--radius-md);
+		cursor: pointer;
+		font-size: 0.85rem;
+	}
+	button.secondary:hover:not(:disabled) {
+		background: var(--bg-elevated);
+		color: var(--text-primary);
+	}
+	button.secondary:disabled {
+		opacity: 0.5;
+		cursor: not-allowed;
+	}
 	.error {
-		color: var(--color-error, #c00);
+		color: var(--color-danger);
 	}
 	.muted {
-		color: var(--color-muted);
+		color: var(--text-muted);
 	}
 	table.queues {
 		width: 100%;
@@ -165,7 +191,7 @@
 	table.queues td {
 		text-align: left;
 		padding: 0.5rem;
-		border-bottom: 1px solid var(--color-border, #eee);
+		border-bottom: 1px solid var(--border);
 	}
 	.num {
 		text-align: right;

dashboard/src/routes/apps/[slug]/queues/[name]/+page.svelte

@@ -47,9 +47,9 @@
 	<title>{name} — Queues — {app?.name ?? slug} — PiCloud</title>
 </svelte:head>
 
-<header>
-	<a class="back" href="{base}/apps/{slug}/queues">← Back to Queues</a>
-	<h1>Queue: <code>{name}</code></h1>
+<header class="panel-head">
+	<a class="back" href="{base}/apps/{slug}/queues">← All queues</a>
+	<h2>Queue: <code>{name}</code></h2>
 </header>
 
 {#if error}
@@ -99,15 +99,20 @@
 {/if}
 
 <style>
-	header {
+	.panel-head {
 		margin-bottom: 1rem;
 	}
 	.back {
 		font-size: 0.875rem;
 		color: var(--color-link);
+		text-decoration: none;
 	}
-	h1 {
+	.back:hover {
+		text-decoration: underline;
+	}
+	h2 {
 		margin: 0.25rem 0;
+		font-size: 1.125rem;
 	}
 	section {
 		margin: 1rem 0;
@@ -118,13 +123,13 @@
 		gap: 0.25rem 1rem;
 	}
 	dt {
-		color: var(--color-muted);
+		color: var(--text-muted);
 	}
 	dd {
 		margin: 0;
 	}
 	.error {
-		color: var(--color-error, #c00);
+		color: var(--color-danger);
 	}
 	.muted {
 		color: var(--color-muted);