Cinder pass across /admin, the login gate, and the library's a11y floor

Uncommitted work from three design runs on this branch, against one design
system: docs/design-system.md is updated to match the CSS, not the reverse.

Library (Reader-facing):
- .chrome sticks at top: 0. Search and the tab row were unreachable three
  screens into a 300-item library, which is exactly where they earn their
  keep; everything above them still scrolls away on purpose.
- One :focus-visible ring (2px --paper) on the nine controls that defined
  none and fell back to the UA blue. .searchbar keeps its border recolour as
  a resting cue but no longer stands in for a ring.
- Mono labels lift 10px -> 11px everywhere. The brief names night reading and
  glare as the usage scene; 10px small-caps was where taste overrode it.
- A card in flight past 2s says "Saving..." and carries aria-busy. htmx sets
  neither, so the wait up to its 15s timeout was silent in both channels.
- Titles clamp at 3 lines; .is-new .title takes width: fit-content, or
  -webkit-box stretches the ember underline past the text it sizes to.

/admin:
- Overview routes into Lanes when a lane is unhealthy, prefixes each figure
  with its column word on the phone layout that drops the thead, labels state
  cells for a screen reader, and has an empty state where the sites table
  assumed rows.
- The admin shell picks up the library's chrome: htmx 15s timeout, the shared
  #notice slot, #sr-announce, filter.js. admin.css follows the same pass.
- admin_render_test.go and card_render_test.go render the templates directly,
  so markup regressions in either surface fail without a browser.

Login:
- DISCORD_GUILD_NAME (optional) names the community on the login screen and
  in the refusal message, so a stranger knows which Discord to ask for an
  invite. Unset degrades to a generic label; neither form names the guild id.

Handlers:
- maxChapterNum (9999) bounds both typed-chapter paths. uiChapter and
  adminSeriesCorrectLatest each parsed a float64 with no ceiling, so a
  hand-rolled POST stored 1e308 and every later reader of that row inherited
  it. Matches the max on the card's chapter input.

go test ./... green.

backend/internal/web/templates/readers.html

@@ -13,9 +13,10 @@
     often a later Poll confirmed or contradicted what that Reader's browser
     reported; enough contradictions stop their reports deferring a Poll, and
     clearing the marks gives that back.</p>
+  {{if .Readers}}
   <ul class="readerlist">
     {{range .Readers}}
-    <li>
+    <li id="reader-{{.ID}}">
       <span class="reader-id">{{.DiscordID}}</span>
       <span class="reader-sessions">{{.Sessions}} session{{if ne .Sessions 1}}s{{end}}</span>
       <span class="reader-sightings">{{.Agreements}} confirmed / {{.Disagreements}} contradicted</span>
@@ -23,26 +24,42 @@
            numbers and a threshold. */}}
       {{if .Blocked}}<span class="reader-blocked">deferral blocked</span>{{end}}
       <span class="reader-actions">
-        {{/* Clearing restores a privilege, so it is a plain ghost button —
-             the destruction accent belongs to revocation alone. It is offered
-             on every row, including one reading zero: the remedy must be
-             findable before the counters climb, not after. */}}
-        <form hx-post="/readers/{{.ID}}/clear-marks" hx-target="#readers" hx-swap="outerHTML"
-              hx-confirm="Clearing wipes this Reader's whole Sighting record, confirmations included. Clear?">
-          <button type="submit" class="ghost">Clear marks</button>
-        </form>
-        {{/* The owner's own row never offers Revoke: it is the one row where the
-             button would sign the tapping browser out, and the endpoint refuses
-             it anyway. Logout is the deliberate way to do that. */}}
+        {{/* Clearing restores a privilege, so its confirm wears the calm wash,
+             not destruction. Revocation destroys sessions, so it wears danger.
+             Both are confirm-gated — the opener never posts. */}}
+        <button type="button" class="ghost" aria-expanded="false" aria-controls="confirm-clear-{{.ID}}"
+                onclick="document.getElementById('confirm-clear-{{.ID}}').hidden = false; this.setAttribute('aria-expanded','true')">Clear marks</button>
         {{if and .Sessions (ne .ID $.OwnerID)}}
-        <form hx-post="/readers/{{.ID}}/revoke" hx-target="#readers" hx-swap="outerHTML"
-              hx-confirm="Revoking signs this Reader out on every device immediately. Revoke?">
-          <button type="submit" class="ghost danger">Revoke sessions</button>
-        </form>
+        <button type="button" class="ghost danger" aria-expanded="false" aria-controls="confirm-revoke-{{.ID}}"
+                onclick="document.getElementById('confirm-revoke-{{.ID}}').hidden = false; this.setAttribute('aria-expanded','true')">Revoke sessions</button>
         {{end}}
       </span>
+      <div class="confirm-row calm" id="confirm-clear-{{.ID}}" role="group" aria-live="polite" hidden>
+        <span>Clear this Reader's Sighting record?</span>
+        <div>
+          <button type="button" class="go"
+                  hx-post="/readers/{{.ID}}/clear-marks" hx-target="#readers" hx-swap="outerHTML"
+                  hx-indicator="#readers" hx-disabled-elt="this">Clear</button>
+          <button type="button" onclick="document.getElementById('confirm-clear-{{.ID}}').hidden = true; var b=document.querySelector('[aria-controls=\'confirm-clear-{{.ID}}\']'); if(b){b.setAttribute('aria-expanded','false'); b.focus();}">Cancel</button>
+        </div>
+      </div>
+      {{if and .Sessions (ne .ID $.OwnerID)}}
+      <div class="confirm-row" id="confirm-revoke-{{.ID}}" role="group" aria-live="polite" hidden>
+        <span>Revoke this Reader's sessions?</span>
+        <div>
+          <button type="button" class="danger-solid"
+                  hx-post="/readers/{{.ID}}/revoke" hx-target="#readers" hx-swap="outerHTML"
+                  hx-indicator="#readers" hx-disabled-elt="this">Revoke</button>
+          <button type="button" onclick="document.getElementById('confirm-revoke-{{.ID}}').hidden = true; var b=document.querySelector('[aria-controls=\'confirm-revoke-{{.ID}}\']'); if(b){b.setAttribute('aria-expanded','false'); b.focus();}">Cancel</button>
+        </div>
+      </div>
+      {{end}}
     </li>
     {{end}}
   </ul>
+  {{else}}
+  <p class="empty">No readers yet — the roster appears after the first Discord sign-in.</p>
+  {{end}}
+  <p class="error-inline" role="status" hidden></p>
 </section>
 {{end}}