refactor(ui): state, not explanation, across every view

[samishal1998]

State, not explanation. Default-visible copy drops from 7,788 to 2,310 words across 23 views (~70%). The pages had been explaining themselves — how ACME issuance works, why a mode inverts, what a label means — which is documentation in the wrong place, and docs/ already holds it.

Biggest movers: SsoView 1119→199, DangerTab 550→214, SubmitView 482→219, ControlView 478→131, RuntimeTab 475→74.

Control stack now leads with a vitals strip (restarts · OOM · mode · cert days · domains) instead of a paragraph describing them.

Interlocks are not copy

An adversarial review of the first pass caught five blockers. Two were defects introduced by the cut itself, not pre-existing:

• The cancel-job toast was replaced by a banner gated on /still there/i.test(warning). The server sends "still that way" — the banner could never render, so a real warning had been deleted and replaced with dead code.
• That banner was also nested inside v-if="isShared", so even with a working predicate it would only appear on shared stacks, wedged inside the teardown confirm.
• Remove wildcard lost every warning while being a variant="danger" button with no confirm. The deleted prose was the only guard on a one-click, host-wide TLS outage.

The cancel predicate is now cancelled.some(j => j.state === 'running') — the same field the server branches its warning on, so the two cannot disagree. Verified end to end: clearStackLocked snapshots the running job before the runner can write Cancelled (it needs the mutex), while the queued path snapshots after endLocked sets it. Unlike matching prose, this is type-guarded — typo'ing the literal fails bun run check with TS2367 (checked by deliberately breaking it).

Remove wildcard gained a confirm plus a one-line consequence. Restored at one line each: the orphaned-axis warning on all three Replacing branches, SSO accounts outliving their provider, the swarm token rotation command, a personal token's blast radius, the wildcard key's 0600/never-returned handling.

Empty and error states keep their qualifiers: an empty control-container list means the project label changed, not that nothing runs; a non-zero log exit stays a hedge rather than an assertion.

Deliberately left

Three views sit above the ≤120-word target — SubmitView 219, DangerTab 214, SsoView 199. These are the interlock-dense pages, and safety interlocks are exempt from the word count: the orphaned-axis and partial-state warnings are the product's central failure modes, not explanation. Every other view is at or under.

The interrupted banner persists rather than clearing on the next action — clearing it means wrapping act, which three other tabs import.

Scope

24 files, all under apps/ui/src. No API, CLI or Go changes, so no conformance or golden impact. bun run check green (14/14).