webapp: fix a11y contrast, heading hierarchy, prefix-safe modal actions

- Accessibility: dark ink (#00003d) on warning/success buttons, badges, and success alert - white text on #ff9500/#0ad64f failed WCAG AA (~2:1); dark-on-bright now passes.
- Heading hierarchy: sidebar brand h1 -> div.brand-title (with matching CSS selector), and standardized all page-header titles to a single <h1> per page (8 templates were h2).
- Prefix-safe modal JS: dashboard/backups/reports/enrollment delete+clone actions now build their form action from url_for(...'__K__'/'__F__').replace(...) instead of hardcoded paths, so they survive a URL-prefix mount.

webapp/templates/reports.html

@@ -3,7 +3,7 @@
 
 {% block content %}
 <div class="page-header">
-  <h2><i class="bi bi-shield-check"></i> Blancco Erasure Reports</h2>
+  <h1><i class="bi bi-shield-check"></i> Blancco Erasure Reports</h1>
   <div class="header-actions">
     <span class="badge badge-secondary badge-lg">{{ reports|length }} report{{ 's' if reports|length != 1 }}</span>
   </div>
@@ -107,7 +107,7 @@ document.getElementById('deleteModal').addEventListener('show.bs.modal', functio
   var btn = event.relatedTarget;
   var filename = btn.getAttribute('data-filename');
   document.getElementById('deleteFilename').textContent = filename;
-  document.getElementById('deleteForm').action = '/reports/delete/' + encodeURIComponent(filename);
+  document.getElementById('deleteForm').action = "{{ url_for('blancco_delete_report', filename='__F__') }}".replace('__F__', encodeURIComponent(filename));
 });
 </script>
 {% endblock %}