feat(ui): share view on steward.css; breadcrumbs everywhere they belong; focus ring; tables scroll in their card (#5095)

#5095 "Share view on the shared stylesheet; breadcrumbs, focus-visible and
wide tables".

- dashboard/share_view.html loads theme.css and steward.css; its own copy of
  the old purple palette is gone. Only the read-only frame and the x/y/w/h
  grid stay inline, written in tokens. HEX_CEILING 75 -> 58.
- Breadcrumbs on settings/general, settings/thresholds, the dashboard share
  page and share-link-created. tests/test_breadcrumbs.py fails on any page
  extending base.html without a crumbs() trail, unless it is on the named
  list of section top pages, logged-out and error pages (rule 134).
- :focus-visible draws --fs-focus-ring on links, buttons, summaries, inputs
  and anything with tabindex.
- Any card holding a .table scrolls sideways (card:has(table.table)), so a
  wide table no longer widens the page at phone width; .card-flush scrolls
  too, main gets min-width:0, and .table-wrap covers a table outside a card.
- tests/test_share_view.py renders the share view: shared sheets, no hex
  colour, escaped name, widgets loading through the share token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_breadcrumbs.py

@@ -0,0 +1,56 @@
+"""Every page below a top-level section shows its trail back up (rule 134).
+
+The breadcrumb block is empty by default, so a nested page that forgets it
+ships with no way back up and nothing says so. Every full page (one that
+extends base.html) must fill the block, unless it is a section's own top
+page, a logged-out page or an error page: those are named below, so adding
+one is a decision someone makes in this file.
+"""
+import re
+
+from tests._templates import REPO, template_files
+
+TOP_LEVEL = {
+    "steward/templates/dashboard/index.html",
+    "steward/templates/status/index.html",
+    "steward/templates/hosts/list.html",
+    "steward/templates/monitors/index.html",
+    "steward/templates/alerts/list.html",
+    "steward/templates/ansible/index.html",
+    "steward/templates/audit/list.html",
+    "steward/templates/ai_access/index.html",
+    "plugins/docker/templates/docker/index.html",
+    "plugins/snmp/templates/snmp/index.html",
+    "plugins/traefik/templates/traefik/index.html",
+    "plugins/unifi/templates/unifi/index.html",
+    # Logged out, or no page to go back up from.
+    "steward/templates/auth/login.html",
+    "steward/templates/auth/setup.html",
+    "steward/templates/errors/404.html",
+    "steward/templates/errors/500.html",
+    "steward/templates/errors/database_unavailable.html",
+}
+
+_EXTENDS_BASE = re.compile(r"""\{%-?\s*extends\s+["']base\.html["']""")
+_BLOCK = re.compile(r"\{%-?\s*block\s+breadcrumb\s*-?%\}(.*?)\{%-?\s*endblock", re.S)
+
+
+def needs_crumbs_and_lacks_them(text: str) -> bool:
+    block = _BLOCK.search(text)
+    return bool(_EXTENDS_BASE.search(text)) and not (block and "crumbs(" in block.group(1))
+
+
+def test_the_guard_can_fail():
+    assert needs_crumbs_and_lacks_them('{% extends "base.html" %}{% block content %}x{% endblock %}')
+    assert needs_crumbs_and_lacks_them('{% extends "base.html" %}{% block breadcrumb %}{% endblock %}')
+    assert not needs_crumbs_and_lacks_them(
+        '{% extends "base.html" %}{% block breadcrumb %}{{ crumbs([("Hosts", "/hosts/"), ("x", "")]) }}{% endblock %}')
+    assert not needs_crumbs_and_lacks_them("<tr><td>a fragment</td></tr>")
+
+
+def test_every_nested_page_has_a_trail():
+    pages = {str(p.relative_to(REPO)): p for p in template_files()}
+    assert TOP_LEVEL <= set(pages), sorted(TOP_LEVEL - set(pages))  # a renamed page leaves no stale entry
+    missing = sorted(name for name, p in pages.items()
+                     if name not in TOP_LEVEL and needs_crumbs_and_lacks_them(p.read_text()))
+    assert not missing, f"add {{% block breadcrumb %}}{{{{ crumbs([...]) }}}} (rule 134): {missing}"

tests/test_share_view.py

@@ -0,0 +1,30 @@
+"""The public share view draws with the same stylesheet as every other page
+(#5095): no palette of its own, so it can never drift from the tokens again."""
+from types import SimpleNamespace
+
+from quart import render_template
+
+from tests.test_style_tokens import hex_colours
+
+
+async def _share_view(app, widgets) -> str:
+    async with app.test_request_context("/share/t0ken"):
+        return await render_template(
+            "dashboard/share_view.html", dashboard=SimpleNamespace(name="Ops <wall>"),
+            widgets=widgets, raw_token="t0ken", poll_interval=30)
+
+
+async def test_the_share_view_uses_the_shared_stylesheet(app):
+    page = await _share_view(app, [])
+    assert "/static/theme.css" in page and "/static/steward.css" in page
+    assert not hex_colours(page), hex_colours(page)
+    assert "Ops &lt;wall&gt;" in page and "<title>Ops &lt;wall&gt; — Steward</title>" in page
+    assert '<div class="empty-state">This dashboard has no widgets.</div>' in page
+
+
+async def test_each_widget_loads_through_the_share_token(app):
+    gw = SimpleNamespace(id=7, grid_x=0, grid_y=2, grid_w=6, grid_h=3)
+    item = SimpleNamespace(db=gw, title="Hosts", hx_url="/w/hosts?id=7", defn=SimpleNamespace(poll=True))
+    page = await _share_view(app, [item])
+    assert 'hx-get="/w/hosts?id=7&s=t0ken"' in page
+    assert "grid-column:1 / span 6;grid-row:3 / span 3;" in page and "every 30s" in page

tests/test_style_tokens.py

@@ -22,7 +22,7 @@ _USED = re.compile(r"var\(\s*(--[\w-]+)")
 # string -- but not an HTML attribute's value (href="#abc" is a link to an id).
 _HEX = re.compile(r"""(?:[:(,]\s*|(?<![\w-]=)['"])#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3})(?![0-9a-zA-Z_-])""")
 
-HEX_CEILING = 75  # measured 2026-10-06 (#5092); lower it as pages move onto tokens, never raise it
+HEX_CEILING = 58  # 75 at #5092, 58 once the share view used steward.css (#5095); only lower it
 
 
 def _sheets():