Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

web/src/themes.ts

@@ -73,7 +73,7 @@ export function currentThemeId(): string {
 // applyTheme sets the variables on <html>, remembers the choice, and tells open
 // terminals to repaint. Cheap enough to call on every load before first render.
 export function applyTheme(id: string) {
-  const t = themeById(id)
+  const t = themeById(id) // unknown ids fall back to the default
   const root = document.documentElement
   for (const [k, v] of Object.entries(t.vars)) root.style.setProperty(k, v)
   root.dataset.theme = t.id