webapp: fix a11y contrast, heading hierarchy, prefix-safe modal actions

- Accessibility: dark ink (#00003d) on warning/success buttons, badges, and success alert - white text on #ff9500/#0ad64f failed WCAG AA (~2:1); dark-on-bright now passes.
- Heading hierarchy: sidebar brand h1 -> div.brand-title (with matching CSS selector), and standardized all page-header titles to a single <h1> per page (8 templates were h2).
- Prefix-safe modal JS: dashboard/backups/reports/enrollment delete+clone actions now build their form action from url_for(...'__K__'/'__F__').replace(...) instead of hardcoded paths, so they survive a URL-prefix mount.

webapp/templates/dashboard.html

@@ -3,7 +3,7 @@
 
 {% block content %}
 <div class="page-header">
-  <h2>Dashboard</h2>
+  <h1>Dashboard</h1>
   <div class="header-actions">
     <a href="{{ url_for('images_import') }}" class="btn btn-outline-secondary btn-sm">
       <i class="bi bi-box-arrow-in-down"></i> Image Import
@@ -267,11 +267,11 @@ document.addEventListener('show.bs.modal', function(e) {
     if (e.target.id === 'cloneImageModal') {
         e.target.querySelector('#cloneSrcKey').textContent = srcKey;
         e.target.querySelector('#cloneSrcFriendly').textContent = srcFriendly;
-        document.getElementById('cloneForm').action = '/images/' + encodeURIComponent(srcKey) + '/clone';
+        document.getElementById('cloneForm').action = "{{ url_for('images_clone', image_type='__K__') }}".replace('__K__', encodeURIComponent(srcKey));
     } else if (e.target.id === 'deleteImageModal') {
         e.target.querySelector('#deleteSrcKey').textContent = srcKey;
         e.target.querySelector('#deleteSrcFriendly').textContent = srcFriendly;
-        document.getElementById('deleteForm').action = '/images/' + encodeURIComponent(srcKey) + '/delete';
+        document.getElementById('deleteForm').action = "{{ url_for('images_delete', image_type='__K__') }}".replace('__K__', encodeURIComponent(srcKey));
     }
 });
 </script>