[jrodal98]

Replace the browser's native confirm() dialogs with a themed in-page modal for all hx-confirm-guarded actions: bookmark delete, nested sub-command delete, API token revoke, and admin user delete.

How it works: htmx fires an htmx:confirm event before falling back to the native dialog. The new static/js/confirm.js intercepts that event, shows the modal from base.html (message from the hx-confirm attribute, Cancel / Confirm buttons), and on confirm calls the event's issueRequest(true) to let the held request proceed. The hx-confirm attributes themselves are untouched — this only replaces the presentation, so the guards and their wording stay exactly as they were. Pages without the modal markup keep the native behavior as a fallback. Cancel via the Cancel button, the backdrop, or Escape.

Why: the native dialogs were the only unthemed UI left in the app, and they can't be driven by browser automation — the Oct 18 post-deploy regression run couldn't revoke its own test API token because the native dialog auto-dismissed. The modal fixes both.

Tests: new tests/confirm_modal_test.rs pins the served pieces (modal markup + buttons + script tag on pages; confirm.js served and intercepting htmx:confirm; modal styles in main.css). The click-through behavior (open → cancel keeps the bookmark; open → confirm deletes it, no native dialog) was verified with Playwright against a local server.