feat(ui): Disk, Traefik, UniFi and Settings say things plainly (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 3:

- Disk page: each tile says what it holds. "Writable layers" becomes
  "Container files" and Build cache says it is safe to clear. Shared is
  "Shared with other images" with a tooltip, and "dangling" is gone.
  Untagged images show by id instead of "<none>", a capped list says
  "The 50 largest of N images", and each host shows "as of" its report.
- Traefik: an expired certificate reads "expired 12 days ago", not "-12
  days" (cert_left). The Traffic empty state knows whether the access log
  is on: off points to Settings → Plugins → Traefik; on says to check the
  mounted log path.
- Moments use |ago with an exact UTC tooltip: UniFi last seen, alarms,
  events, speed test and DPI; AI token last used.
- Settings: the Auth tab is "Authentication" like its breadcrumb, plugin
  fields read "Metrics URL" not metrics_url (field_label), a source's pull
  interval is "every 1h", and the last report time drops the ISO "T".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/docker/test_docker_page.py

@@ -139,3 +139,26 @@ async def test_a_failing_service_leads_and_the_failures_are_listed(app):
     assert listed.index("codex_db") < listed.index("backup")              # newest first
     assert "9 failures · last: task: non-zero exit (1) · nas" in listed
     assert 'href="/plugins/docker/container/h1/backup">backup</a>' in listed
+
+
+async def test_the_disk_page_explains_its_terms_and_names_untagged_images(app):
+    """#5212: no unexplained jargon, no "<none>" rows, and a capped list says so."""
+    summary = {"images_total": 312, "images_active": 40, "images_size": "40 GiB",
+               "images_reclaimable": "12 GiB", "layers_size": "30 GiB", "containers_count": 9,
+               "containers_size": "1.2 GiB", "volumes_count": 4, "volumes_size": "3 GiB",
+               "build_cache_size": "2 GiB"}
+    images = [{"repo_tag": "nginx:1", "image_id": "aaaaaaaaaaaa", "size": "180 MiB", "shared": "70 MiB",
+               "containers": 2, "reclaimable": False},
+              {"repo_tag": None, "image_id": "bbbbbbbbbbbb", "size": "700 MiB", "shared": "0 B",
+               "containers": 0, "reclaimable": True}]
+    group = {"host_id": "h1", "host_name": "nas", "as_of": NOW - timedelta(minutes=2), "summary": summary,
+             "stopped": 1, "images": images, "has_target": True, "images_capped": True}
+    async with app.test_request_context("/plugins/docker/disk"):
+        page = await render_plugin_template(app, "docker", "docker/disk.html",
+                                            host_groups=[group], ansible_available=True)
+    assert "untagged</span> bbbbbbbbbbbb" in page and "&lt;none&gt;" not in page
+    assert "The 2 largest of 312 images" in page and "as of <time" in page
+    assert "Writable layers" not in page and "Container files" in page
+    assert "held by images no container uses" in page and "safe to clear" in page
+    assert "Shared with other images" in page and "2 containers" in page and ">nothing<" in page
+    assert "dangling" not in page

tests/plugins/traefik/test_traefik_page.py

@@ -88,3 +88,25 @@ async def test_gone_routers_are_listed_by_when_they_were_last_seen(app):
     assert "1 router no longer reported</summary>" in page
     assert "old</span> <span class=\"problem-detail\">last seen <time" in page and ">2h ago</time>" in page
     assert "Failing" not in page
+
+
+@pytest.mark.parametrize("days, says", [
+    (12.7, "12 days"), (1.2, "1 day"), (0.4, "expires today"),
+    (-0.3, "expired today"), (-1.5, "expired 1 day ago"), (-12.0, "expired 12 days ago"), (None, "—"),
+])
+def test_a_certificate_past_its_date_says_expired(days, says):
+    """#5212: "expired 12 days ago", never "-12 days"."""
+    from steward.core.formatting import cert_left
+    assert cert_left(days) == says
+
+
+@pytest.mark.parametrize("enabled, says, not_says", [
+    (False, "The access log is off", "No requests in the last"),
+    (True, "No requests in the last 24h", "The access log is off"),
+])
+async def test_the_traffic_empty_state_knows_whether_the_log_is_on(app, enabled, says, not_says):
+    async with app.test_request_context("/plugins/traefik/traffic"):
+        page = await render_plugin_template(app, "traefik", "traefik/traffic.html", summary=None, history=[],
+                                            range_key="24h", access_log_enabled=enabled,
+                                            access_log_path="/var/log/traefik/access.log")
+    assert says in page and not_says not in page