fix(ui): delete prompts use data-confirm, so a quote in a name no longer runs script (#5099)

#5099 "A name containing a quote runs script when an admin clicks Delete".
Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are
HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a
name such as  x');fetch(…);//  from running.

- Every prompt (22 handlers, plus the docker prune and token revoke ones)
  is now data-confirm="…", read through dataset by one submit listener in
  base.html; nothing rendered is parsed as JavaScript.
- The remaining inline handlers take integers only (|int), and the time
  range buttons pass this.dataset.range.
- tests/test_inline_handlers.py fails on any {{ }} in an inline handler that
  is not |int, with a self-test; tests/_templates.py is the one template
  walker the template guards now share.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/ansible/browse.html

@@ -28,7 +28,7 @@
             {% if view_editable and session.user_role == 'admin' %}
             <a href="/ansible/playbooks/edit/{{ view_source }}/{{ view_path }}" class="btn btn-sm">Edit</a>
             <form method="post" action="/ansible/playbooks/delete" style="display:inline;"
-                  onsubmit="return confirm('Delete {{ view_path }}?');">{{ csrf_field() }}
+                  data-confirm="Delete {{ view_path }}?">{{ csrf_field() }}
                 <input type="hidden" name="source_name" value="{{ view_source }}">
                 <input type="hidden" name="playbook_path" value="{{ view_path }}">
                 <button type="submit" class="btn btn-sm btn-danger">Delete</button>

steward/templates/ansible/inventory/groups.html

@@ -40,7 +40,7 @@
             <a href="/ansible/inventory/groups/{{ grp.id }}" class="btn btn-sm btn-ghost">Edit</a>
             <form method="post" action="/ansible/inventory/groups/{{ grp.id }}/delete" style="display:inline;">{{ csrf_field() }}
                 <button type="submit" class="btn btn-sm btn-danger"
-                        onclick="return confirm('Delete group {{ grp.name }}?')">×</button>
+                        data-confirm="Delete group {{ grp.name }}?">×</button>
             </form>
         </td>
     </tr>

steward/templates/ansible/inventory/targets.html

@@ -49,7 +49,7 @@
             <a href="/ansible/inventory/targets/{{ tgt.id }}" class="btn btn-sm btn-ghost">Edit</a>
             <form method="post" action="/ansible/inventory/targets/{{ tgt.id }}/delete" style="display:inline;">{{ csrf_field() }}
                 <button type="submit" class="btn btn-sm btn-danger"
-                        onclick="return confirm('Delete target {{ tgt.name }}?')">×</button>
+                        data-confirm="Delete target {{ tgt.name }}?">×</button>
             </form>
         </td>
     </tr>

steward/templates/ansible/playbook_editor.html

@@ -54,7 +54,7 @@
 
 {% if editing %}
 <form method="post" action="/ansible/playbooks/delete" style="margin-top:1rem;"
-      onsubmit="return confirm('Delete {{ playbook_path }}?');">{{ csrf_field() }}
+      data-confirm="Delete {{ playbook_path }}?">{{ csrf_field() }}
   <input type="hidden" name="source_name" value="{{ source_name }}">
   <input type="hidden" name="playbook_path" value="{{ playbook_path }}">
   <button type="submit" class="btn btn-danger btn-sm">Delete playbook</button>

steward/templates/ansible/run_detail.html

@@ -7,7 +7,7 @@
     <h1 class="page-title" style="margin-bottom:0;">Run Detail</h1>
     <div style="margin-left:auto;display:flex;gap:0.5rem;">
         {% if run.status.value in ("running", "queued") and session.user_role in ("operator", "admin") %}
-        <form method="post" action="/ansible/runs/{{ run.id }}/cancel" onsubmit="return confirm('Cancel this run?');">{{ csrf_field() }}
+        <form method="post" action="/ansible/runs/{{ run.id }}/cancel" data-confirm="Cancel this run?">{{ csrf_field() }}
             <button type="submit" class="btn btn-sm btn-danger">Cancel run</button>
         </form>
         {% endif %}

steward/templates/ansible/schedules.html

@@ -62,7 +62,7 @@
       </form>
       <a href="?edit={{ s.id }}#form" class="btn btn-sm btn-ghost">Edit</a>
       <form method="post" action="/ansible/schedules/{{ s.id }}/delete" style="display:inline;"
-            onsubmit="return confirm('Delete schedule {{ s.name }}?');">{{ csrf_field() }}
+            data-confirm="Delete schedule {{ s.name }}?">{{ csrf_field() }}
         <button class="btn btn-sm btn-danger" type="submit">Delete</button>
       </form>
     </td>