fix(dashboard): admin-UI cleanup sweep

Family-wide admin-UI cleanup pass (scadaproj admin_ui_cleanup.md) applied to the
Blazor dashboard. Behaviour is unchanged throughout — no @onclick, disabled,
binding, auth gate, or arm->confirm flow was touched.

Uncontrolled error text is now truncated at the render site. Fault messages,
Galaxy load errors, and browse-tree load failures were rendered in full into
fixed-width table cells, where a long exception string blows out the column.
Each site gets DashboardDisplay.Abbreviate plus a title attribute carrying the
untruncated text, so nothing becomes unreachable. Abbreviate is length-checked
rather than a bare range slice: `value[..n]` on a shorter string throws and
takes the whole page render down with it. The two detail views whose entire
purpose is to show one fault in full — SessionDetailsPage and GalaxyPage's
Last Error — are deliberately left untruncated.

Two classes referenced from markup had no definition anywhere in the sheet.
.browse-stale-banner was inert; .tree-load-status was a real visual defect —
loading and failed-to-load rows sit among .tree-row siblings and carry the same
leading .tree-toggle-empty spacer, but that spacer only takes its width as a
flex item, so without a flex container those rows lost their indent.

Confirm/cancel pairs in ConfirmDialog and the API-key create form are now
btn-groups with role="group" and an aria-label, replacing margin-spaced loose
buttons.

Removes a paragraph on GalaxyPage naming internal RPCs (DiscoverHierarchy,
GetLastDeployTime) — implementation detail with no meaning to a dashboard
operator.

Verified in a real browser, not bUnit: full build clean, 879/879 tests, and a
live gate against a running dashboard with a genuine ~250-char SqlClient
exception as the erroring row. Results per check, including the checks that
could NOT be exercised without an x86 worker, are recorded in
docs/plans/2026-08-11-dashboard-ui-sweeps.md.

That plan doc also records a correction: this app is NOT Bootstrap-free. The
sweep brief said it was, citing the scadaproj index; libman.json pins
bootstrap 5.3.3 and App.razor:7 links it ahead of the theme. The stale claim had
already cost this app one skipped family sweep (scadaproj#2, the /admin/secrets
modal), so that modal was live-gated here too and passes.

src/ZB.MOM.WW.MxGateway.Server/wwwroot/css/site.css

@@ -301,6 +301,14 @@ code {
 .browse-panel { margin-top: 0; }
 
 .browse-search { margin-bottom: 0.6rem; }
+
+/* Click-to-dismiss "Galaxy redeployed" notice above the tree. The whole banner
+   is the dismiss target, so it has to read as one. */
+.browse-stale-banner {
+  cursor: pointer;
+  padding: 0.4rem 0.7rem;
+  margin-bottom: 0.6rem;
+}
 .browse-search-note {
   margin-top: 0.5rem;
   font-size: 0.74rem;
@@ -345,6 +353,22 @@ code {
 }
 .tree-toggle-empty { cursor: default; }
 
+/* Loading / failed-to-load rows sit among .tree-row siblings and carry the same
+   leading .tree-toggle-empty spacer. The spacer only takes its width as a flex
+   item, so this container has to be flex or the row loses its indent. */
+.tree-load-status {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.12rem 0.5rem;
+  font-size: 0.82rem;
+}
+.tree-load-status > span:not(.tree-toggle) {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 .tree-label {
   display: flex;
   align-items: center;