feat(dashboard): unified design system + persistent per-app tab bar

Addresses two interrelated UX complaints:

1. Browser-default controls leaking through the dark theme
   (native <select> chevrons, OS checkbox/radio look, date-picker
   icons, <details> triangle marker, number input spinners).
2. Subroute pages dropping the main app's tab bar in favor of a back
   link, breaking navigation continuity across users/files/queues/
   dead-letters/queues-[name].

Design tokens (dashboard/src/routes/+layout.svelte):

- Token vocabulary expanded with 18 new variables covering
  text-strong, accent + accent-fg, danger/success/warning bg/fg/border
  triplets, bg-elevated-hover, radii (sm/md/lg/pill), shadow-elev-2,
  and z scale (popover/modal/toast). 7 alias tokens (--muted,
  --link, --text, --color-error, --color-border, --chip-bg,
  --code-bg) absorb the orphan references the F-U-004 remediation
  partially renamed.
- Global :global(...) resets for <select>, <input type='checkbox'>,
  <input type='radio'>, <input type='number'>, <input type='date'>,
  and <details>/<summary> ensure native controls track the dark
  palette out of the box. No per-page edits needed.

Tab consistency:

- New dashboard/src/lib/AppTabBar.svelte renders all 11 per-app
  tabs (Scripts, Domains, Members, Triggers, Topics, Secrets,
  Settings, Users, Files, Queues, Dead letters) as <a> links with
  an active highlight derived from the URL. Tabs that switch
  in-page panels go to ?tab=<id>; tabs that switch routes go to
  the subroute. Admin-only tabs are hidden when canAdmin is false.
- New dashboard/src/routes/apps/[slug]/+layout.svelte loads the
  app once, handles the historical-slug redirect, exposes the
  shared app + canAdmin + canWrite + dead-letter-count state via
  Svelte context, and renders the breadcrumb + AppTabBar above
  every per-app page. The 5 subroute pages drop their own "← back"
  headers since the layout owns them now.
- apps/[slug]/+page.svelte's local-state activeTab becomes URL-
  driven via $page.url.searchParams.get('tab'). Defense-in-depth
  redirect for non-admin viewers landing on admin-only tabs uses
  goto({replaceState:true}) instead of mutating state.

Light-theme leftovers swept on 5 subroute pages:

- dead-letters: error banner, badge, pre/code blocks all swap to
  --color-danger-*, --bg-elevated, --text-primary
- files: button.danger, var(--muted,#666) → token-only
- queues + queues/[name]: bare hex fallbacks removed; .toolbar and
  .auto-refresh styled with tokens; data-testid for the queues
  empty state (already added by previous commit, reaffirmed here)
- users + users/invitations: badge-ok/badge-pending now use
  --color-success-bg/fg and --color-warning-bg/fg; chips use
  --bg-elevated + --text-strong; .create-form gets a token-styled
  surface; row-action buttons gain explicit dark-theme styling

E2E selector updates:

- members.spec.ts, integration.spec.ts, apps.spec.ts — the tab bar
  is now <a> elements (role=link) without a count suffix. Test
  selectors swap from getByRole('button', name: /^Scripts \(\d+\)$/)
  to getByRole('link', { name: 'Scripts' }), etc.
- New navigation/tabs.spec.ts still passes; existing 60+ tests
  unchanged except for the selector swap. Two pre-existing failures
  (routing.spec.ts:79, integration.spec.ts:89) untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/tests/e2e/apps/apps.spec.ts

@@ -99,7 +99,7 @@ test.describe('B2 apps lifecycle', () => {
 
 		await page.getByRole('link', { name: new RegExp(slug) }).click();
 		await expect(page).toHaveURL(new RegExp(`/admin/apps/${slug}$`));
-		await page.getByRole('button', { name: 'Settings' }).click();
+		await page.getByRole('link', { name: 'Settings' }).click();
 
 		const newName = `${slug} renamed`;
 		const newDesc = 'updated description';
@@ -111,7 +111,7 @@ test.describe('B2 apps lifecycle', () => {
 		await expect(page.getByRole('button', { name: 'Save changes' })).toBeEnabled();
 
 		await page.reload();
-		await page.getByRole('button', { name: 'Settings' }).click();
+		await page.getByRole('link', { name: 'Settings' }).click();
 		await expect(page.getByLabel('Name')).toHaveValue(newName);
 		await expect(page.getByLabel('Description')).toHaveValue(newDesc);
 	});
@@ -125,7 +125,7 @@ test.describe('B2 apps lifecycle', () => {
 		cleanup.app(slug); // belt-and-braces; cleanup is best-effort
 
 		await page.getByRole('link', { name: new RegExp(slug) }).click();
-		await page.getByRole('button', { name: 'Settings' }).click();
+		await page.getByRole('link', { name: 'Settings' }).click();
 		await page.getByRole('button', { name: 'Delete app' }).click();
 
 		const dialog = page.getByRole('dialog');
@@ -251,7 +251,7 @@ test.describe('B2 apps adversarial', () => {
 		cleanup.app(slug);
 		await expect(page.getByRole('link', { name: new RegExp(slug) })).toBeVisible();
 		await page.goto(`/admin/apps/${slug}`);
-		await expect(page.getByRole('button', { name: 'Settings' })).toBeVisible();
+		await expect(page.getByRole('link', { name: 'Settings' })).toBeVisible();
 	});
 });
 
@@ -296,12 +296,12 @@ test.describe('B2 apps role shadowing', () => {
 		try {
 			await page.goto(`/admin/apps/${slug}`);
 			await expect(
-				page.getByRole('button', { name: /^Scripts \(\d+\)$/ })
+				page.getByRole('link', { name: 'Scripts' })
 			).toBeVisible();
 			// Settings tab is absent.
-			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
+			await expect(page.getByRole('link', { name: 'Settings' })).toHaveCount(0);
 			// Domains tab still listable, but no Add-domain submit.
-			await page.getByRole('button', { name: /^Domains \(\d+\)$/ }).click();
+			await page.getByRole('link', { name: 'Domains' }).click();
 			await expect(page.getByRole('button', { name: /^Add domain$/ })).toHaveCount(0);
 		} finally {
 			await page.context().close();
@@ -324,9 +324,9 @@ test.describe('B2 apps role shadowing', () => {
 		try {
 			await page.goto(`/admin/apps/${slug}`);
 			await expect(page.getByRole('button', { name: /^New script$/ })).toBeVisible();
-			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
+			await expect(page.getByRole('link', { name: 'Settings' })).toHaveCount(0);
 			await expect(
-				page.getByRole('button', { name: /^Members \(\d+\)$/ })
+				page.getByRole('link', { name: 'Members' })
 			).toHaveCount(0);
 		} finally {
 			await page.context().close();

dashboard/tests/e2e/integration/integration.spec.ts

@@ -47,14 +47,14 @@ test('end-to-end: app + domain + script + route via dashboard → invoke via pub
 	// 2. Open the app and claim the domain on the Domains tab.
 	await page.getByRole('link', { name: new RegExp(slug) }).click();
 	await expect(page).toHaveURL(new RegExp(`/admin/apps/${slug}$`));
-	await page.getByRole('button', { name: /^Domains \(\d+\)$/ }).click();
+	await page.getByRole('link', { name: 'Domains' }).click();
 	const domainForm = page.locator('form.create-form.inline');
 	await domainForm.getByPlaceholder(/app\.example\.com/).fill(domain);
 	await domainForm.getByRole('button', { name: /^Add domain$/ }).click();
 	await expect(page.locator('.domain-row')).toContainText(domain);
 
 	// 3. Create the script on the Scripts tab.
-	await page.getByRole('button', { name: /^Scripts \(\d+\)$/ }).click();
+	await page.getByRole('link', { name: 'Scripts' }).click();
 	await page.getByRole('button', { name: /^New script$/ }).click();
 	await page.getByLabel('Name').fill(scriptName);
 	await fillCodeMirror(page, '.cm-content', scriptSource);

dashboard/tests/e2e/members/members.spec.ts

@@ -47,7 +47,7 @@ test.describe('B5 app members', () => {
 		cleanup.adminUser(userId);
 
 		await page.goto(`/admin/apps/${slug}`);
-		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
+		await page.getByRole('link', { name: 'Members' }).click();
 
 		// Invite. Both selects sit in `form.create-form`; locate them
 		// by position to avoid getByLabel ambiguity (the Svelte
@@ -92,7 +92,7 @@ test.describe('B5 app members', () => {
 		}
 
 		await page.goto(`/admin/apps/${slug}`);
-		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
+		await page.getByRole('link', { name: 'Members' }).click();
 		await page.getByRole('button', { name: new RegExp(`Member actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Make editor$/ }).click();
 
@@ -131,11 +131,11 @@ test.describe('B5 app members', () => {
 			await viewerPage.goto(`/admin/apps/${slug}`);
 			// Scripts tab loads — that's what a viewer sees.
 			await expect(
-				viewerPage.getByRole('button', { name: /^Scripts \(\d+\)$/ })
+				viewerPage.getByRole('link', { name: 'Scripts' })
 			).toBeVisible();
 			// Members tab button is absent for non-app-admins.
 			await expect(
-				viewerPage.getByRole('button', { name: /^Members \(\d+\)$/ })
+				viewerPage.getByRole('link', { name: 'Members' })
 			).toHaveCount(0);
 		} finally {
 			await viewerPage.context().close();
@@ -157,7 +157,7 @@ test.describe('B5 app members adversarial', () => {
 		cleanup.adminUser(userId);
 
 		await page.goto(`/admin/apps/${slug}`);
-		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
+		await page.getByRole('link', { name: 'Members' }).click();
 		const form = page.locator('form.create-form');
 		const roleSelect = form.locator('select').nth(1);
 		const optionValues = await roleSelect.evaluate((el: HTMLSelectElement) =>