fix(ui): delete prompts use data-confirm, so a quote in a name no longer runs script (#5099)

#5099 "A name containing a quote runs script when an admin clicks Delete".
Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are
HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a
name such as  x');fetch(…);//  from running.

- Every prompt (22 handlers, plus the docker prune and token revoke ones)
  is now data-confirm="…", read through dataset by one submit listener in
  base.html; nothing rendered is parsed as JavaScript.
- The remaining inline handlers take integers only (|int), and the time
  range buttons pass this.dataset.range.
- tests/test_inline_handlers.py fails on any {{ }} in an inline handler that
  is not |int, with a self-test; tests/_templates.py is the one template
  walker the template guards now share.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/hosts/detail.html

@@ -16,7 +16,7 @@
     <a href="/hosts/{{ host.id }}/edit" class="btn btn-ghost btn-sm">Edit</a>
     {% if session.user_role == 'admin' %}
     <form method="post" action="/hosts/{{ host.id }}/delete" style="margin:0;"
-          onsubmit="return confirm('Delete host {{ host.name }}? Monitors and history are removed.');">{{ csrf_field() }}
+          data-confirm="Delete host {{ host.name }}? Monitors and history are removed.">{{ csrf_field() }}
       <button type="submit" class="btn btn-danger btn-sm">Delete</button>
     </form>
     {% endif %}
@@ -78,7 +78,7 @@
     <div style="display:flex;gap:0.35rem;flex-shrink:0;">
       <a href="/monitors/{{ m.id }}/edit" class="btn btn-sm btn-ghost" style="padding:0.2rem 0.5rem;font-size:0.72rem;">Edit</a>
       <form method="post" action="/monitors/{{ m.id }}/delete" style="display:inline;"
-            onsubmit="return confirm('Delete monitor {{ m.name }}?');">{{ csrf_field() }}
+            data-confirm="Delete monitor {{ m.name }}?">{{ csrf_field() }}
         <button type="submit" class="btn btn-sm" style="padding:0.2rem 0.5rem;font-size:0.72rem;color:var(--red);">✕</button>
       </form>
     </div>

steward/templates/hosts/list.html

@@ -80,7 +80,7 @@
                     <a href="/hosts/{{ host.id }}/edit" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
                     <form method="post" action="/hosts/{{ host.id }}/delete" style="display:inline;">{{ csrf_field() }}
                         <button type="submit" class="btn btn-sm btn-danger"
-                            onclick="return confirm('Delete {{ host.name }}?')">Delete</button>
+                            data-confirm="Delete {{ host.name }}?">Delete</button>
                     </form>
                 </td>
             </tr>