fix(ui): delete prompts use data-confirm, so a quote in a name no longer runs script (#5099)

#5099 "A name containing a quote runs script when an admin clicks Delete".
Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are
HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a
name such as  x');fetch(…);//  from running.

- Every prompt (22 handlers, plus the docker prune and token revoke ones)
  is now data-confirm="…", read through dataset by one submit listener in
  base.html; nothing rendered is parsed as JavaScript.
- The remaining inline handlers take integers only (|int), and the time
  range buttons pass this.dataset.range.
- tests/test_inline_handlers.py fails on any {{ }} in an inline handler that
  is not |int, with a self-test; tests/_templates.py is the one template
  walker the template guards now share.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_style_tokens.py

@@ -11,6 +11,7 @@ import pathlib
 import re
 
 import steward
+from tests._templates import template_files as _templates
 
 _REPO = pathlib.Path(steward.__file__).parent.parent
 _STATIC = _REPO / "steward" / "static"
@@ -24,11 +25,6 @@ _HEX = re.compile(r"""(?:[:(,]\s*|(?<![\w-]=)['"])#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]
 HEX_CEILING = 75  # measured 2026-10-06 (#5092); lower it as pages move onto tokens, never raise it
 
 
-def _templates():
-    for root in [_REPO / "steward" / "templates", *(_REPO / "plugins").glob("*/templates")]:
-        yield from root.rglob("*.html")
-
-
 def _sheets():
     return [p for p in _STATIC.rglob("*.css") if "vendor" not in p.parts]