Batch of accessibility and touch fixes from the audit

- Esc closes whichever panel a card has open and returns focus to the cell that
  owns it; opening a confirm row moves focus to its primary button, so the
  announcement is deterministic and tab order stays inside the confirm.
- The inline error scrolls itself into view and no longer self-destructs after
  5s: this reader gets interrupted mid-tap, and an expiring notice left a failed
  write with no trace at all. It clears on the next request from that card.
- Every tab clears 44px wide (All was 15.25); desktop action cells go 40 -> 44.
- login.html's error gets role="alert".
- The card monogram carries its own aria-hidden — Chromium exposes it through
  the cover link's, because that link is programmatically focusable.
- The busy bar ends its travel flush with the card edge, so .card.htmx-request
  no longer needs overflow: hidden and cannot clip a panel mid-request.

Verified at 390 and 1280 in both themes; detector over templates+static reports
only the two known Instrument Serif false positives.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/templates/login.html

@@ -21,7 +21,9 @@
         <input id="password" name="password" type="password"
                autocomplete="current-password" autofocus required>
       </div>
-      <p class="error">{{.Error}}</p>
+      {{/* The page reloads on a failed sign-in, so the message is present from
+           the start; role=alert is what gets it announced anyway. */}}
+      <p class="error" role="alert">{{.Error}}</p>
       <button type="submit">Sign in</button>
     </form>
   </main>