feat(settings): Settings brought into line with the rest of Steward (milestone 493)

The last page of #5214's walk. Settings still described Steward as it was
before monitors were unified and SNMP was rebuilt, drew its tabs below the
breadcrumb, and showed the report schedule in UTC.

- Tabs (#5377): settings/_tabs.html is a settings_tabs() macro called in
  each page's section_tabs block, above the trail, as Ansible's are. The
  breadcrumb guard also fails any page that {% include %}s a tab strip.
- Report time (#5378): reports.schedule_tz keeps the zone of whoever saved
  the schedule; check_and_send compares in it (report_due), and the form shows
  the day and hour on the reader's clock (schedule_in) under their zone's
  name. "Last sent" uses |when.
- Wording (#5379): the report contents list what the report holds (monitors,
  not ping-enabled hosts); "Ping latency" is "Response time" and says what it
  grades; plugin detail says enabling loads now and disabling needs a
  restart; the monitor interval says it applies on the next check (the
  scheduler reads it every pass); the dead list-config branch is gone.
- Traefik (#5380): the 5xx and 4xx cutoffs are settings
  (traefik.threshold.error_5xx_pct 0.1, error_4xx_pct 1.0) in a "Traefik
  routers" group on Thresholds while the plugin runs, read by router_state
  through error_cutoffs(). The Traefik page has a Thresholds button for
  admins, to /settings/thresholds/#traefik.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_report_schedule.py

@@ -0,0 +1,31 @@
+"""The weekly report's hour is kept in the zone of whoever saved it, and a
+reader sees it on their own clock (#5378)."""
+from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
+
+from steward.core.reports import report_due, schedule_in
+
+NY = ZoneInfo("America/New_York")
+BERLIN = ZoneInfo("Europe/Berlin")
+
+
+def test_sunday_eight_in_new_york_is_due_at_noon_utc_in_october():
+    sunday_noon_utc = datetime(2026, 10, 11, 12, 30, tzinfo=timezone.utc)   # 08:30 EDT
+    assert report_due(sunday_noon_utc, 6, 8, NY)
+    assert not report_due(sunday_noon_utc, 6, 8, timezone.utc)
+    assert not report_due(datetime(2026, 10, 11, 8, 30, tzinfo=timezone.utc), 6, 8, NY)
+
+
+def test_a_reader_sees_the_saved_hour_on_their_own_clock():
+    now = datetime(2026, 10, 8, 15, 0, tzinfo=timezone.utc)
+    assert schedule_in(6, 8, NY, NY, now) == (6, 8)
+    assert schedule_in(6, 8, NY, BERLIN, now) == (6, 14)
+    assert schedule_in(6, 8, timezone.utc, NY, now) == (6, 4)      # an old UTC schedule, read in New York
+    assert schedule_in(0, 1, timezone.utc, NY, now) == (6, 21)     # Monday 01:00 UTC is Sunday evening there
+
+
+def test_what_a_reader_picks_and_saves_is_what_they_see_again():
+    now = datetime(2026, 10, 8, 15, 0, tzinfo=timezone.utc)
+    for day in range(7):
+        for hour in (0, 8, 23):
+            assert schedule_in(day, hour, BERLIN, BERLIN, now) == (day, hour)

tests/core/test_settings_pages.py

@@ -0,0 +1,42 @@
+"""Settings pages say what Steward does now, in the reader's zone (milestone 493)."""
+from quart import render_template, session
+
+from steward.core.settings import DEFAULTS
+
+
+def _settings(**over):
+    return {**DEFAULTS, **over}
+
+
+async def _render(app, name, path, tz="America/New_York", **ctx):
+    async with app.test_request_context(path):
+        session["user_role"] = "admin"
+        session["tz"] = tz
+        return await render_template(name, **ctx)
+
+
+async def test_reports_name_the_readers_zone_and_what_the_report_holds(app):
+    page = await _render(app, "settings/reports.html", "/settings/reports/", settings=_settings(),
+                         flash=None, shown_day=6, shown_hour=4, last_sent=None)
+    assert "UTC" not in page[page.index("<main"):]
+    assert "At hour (E" in page                                    # EDT or EST, by the date
+    assert '<option value="4" selected>' in page.replace("\n", "").replace("  ", "")
+    assert "ping-enabled" not in page and "Monitors down now" in page
+
+
+async def test_the_traefik_group_shows_only_while_the_plugin_runs(app):
+    on = await _render(app, "settings/thresholds.html", "/settings/thresholds/", settings=_settings(),
+                       traefik_on=True)
+    off = await _render(app, "settings/thresholds.html", "/settings/thresholds/", settings=_settings(),
+                        traefik_on=False)
+    assert 'id="traefik"' in on and 'name="error_5xx_pct"' in on and 'value="0.1"' in on
+    assert 'id="traefik"' not in off
+    assert "Ping widget" not in on and "Response time" in on
+
+
+async def test_settings_tabs_sit_above_the_trail(app):
+    page = await _render(app, "settings/thresholds.html", "/settings/thresholds/", settings=_settings(),
+                         traefik_on=False)
+    tabs, trail = page.index('aria-label="Settings"'), page.index('aria-label="Breadcrumb"')
+    assert tabs < trail
+    assert '<a href="/settings/thresholds/" aria-current="page">' in page

tests/plugins/traefik/test_traefik_page.py

@@ -291,3 +291,25 @@ async def test_the_config_tile_says_when_it_last_reloaded(app):
                                             error_4xx=1.0, error_5xx=0.1)
     assert "Config reloaded" in page and "3m ago" in page and "343 reloads" in page
     assert "Reload failed" not in page
+
+
+# ── Error cutoffs are settings, reachable from the page (#5380) ─────────────
+
+def test_router_state_reads_the_error_cutoffs_from_settings():
+    strict = to_thresholds_cfg({"traefik.threshold.error_5xx_pct": 0.0, "traefik.threshold.error_4xx_pct": 0.2})
+    lenient = to_thresholds_cfg({"traefik.threshold.error_5xx_pct": 5.0, "traefik.threshold.error_4xx_pct": 10.0})
+    assert router_state(_latest(e5=0.05), strict)[0] == "crit"
+    assert router_state(_latest(e5=0.05), TH)[0] == "ok"           # under the 0.1% default
+    assert router_state(_latest(e5=2.5), lenient)[0] == "ok"
+    assert router_state(_latest(e4=0.5), strict)[0] == "warn"
+    assert router_state(_latest(e4=5.0), lenient)[0] == "ok"
+
+
+@pytest.mark.parametrize("role, linked", [("admin", True), ("viewer", False)])
+async def test_the_page_links_an_admin_to_the_router_thresholds(app, role, linked):
+    from quart import session
+    async with app.test_request_context("/plugins/traefik/"):
+        session["user_role"] = role
+        page = await render_plugin_template(app, "traefik", "traefik/index.html", poll_interval=30,
+                                            access_log_enabled=False, current_range="1h")
+    assert ('href="/settings/thresholds/#traefik"' in page) is linked

tests/test_breadcrumbs.py

@@ -80,6 +80,22 @@ def test_section_tabs_sit_above_the_trail():
     assert base.index("{% block section_tabs %}") < base.index("{% block breadcrumb %}")
     pages = [p for p in template_files() if _EXTENDS_BASE.search(p.read_text())]
     tabbed = [p for p in pages if _TABS_CALL.search(p.read_text())]
-    assert len(tabbed) >= 10, [str(p) for p in tabbed]  # the ten Ansible pages, at least
+    assert len(tabbed) >= 18, [str(p) for p in tabbed]  # the ten Ansible pages and eight Settings pages
     wrong = sorted(str(p.relative_to(REPO)) for p in tabbed if tabs_outside_their_block(p.read_text()))
     assert not wrong, f"move the tabs into {{% block section_tabs %}}: {wrong}"
+
+
+# A tab strip pulled in with {% include %} lands wherever the include sits, which
+# is how Settings drew its tabs under the trail unnoticed (#5377). Tabs come only
+# from a *_tabs() macro call, which the guard above places.
+_TABS_INCLUDE = re.compile(r"\{%-?\s*include\s+[\"'][^\"']*_tabs\.html")
+
+
+def test_the_include_guard_can_fail():
+    assert _TABS_INCLUDE.search('{% include "settings/_tabs.html" %}')
+    assert not _TABS_INCLUDE.search('{% from "settings/_tabs.html" import settings_tabs %}')
+
+
+def test_no_page_includes_a_tab_strip():
+    included = sorted(str(p.relative_to(REPO)) for p in template_files() if _TABS_INCLUDE.search(p.read_text()))
+    assert not included, f"call the section's *_tabs() macro in {{% block section_tabs %}}: {included}"