refine post-install and hardware GPU docs, Monitor UX and CLI styling

- rewrite the 15 post-install pages and the 3 hardware GPU pages so they reflect the current scripts (reversibility, tracked-tool counts, kernel parameters, per-tool commands, Alpine LXC propagation flow)
- migrate the legacy step-badge helper on post-install/optional and create-vm/synology to the canonical pill component, with the stepLabel key added in each locale
- fix rich-text i18n calls missing helpers across network, automated, optional, security, customization and the post-install landing pages, and escape the `<iface>` placeholder in automated so intl no longer parses it as a tag
- remove the mouse-follow blue overlay from the docs landing layout
- reposition the App-tab Edit button and stack the Search and Register controls vertically on mobile
- move the Bulk update Configure/Edit control into the section header so it behaves the same on desktop and mobile
- show a spinner during the final autoremove/autoclean pass of update-pve-safe so the cleanup step reads as active instead of silent
- restyle the shell spinner and msg_info in a distinctive purple and drop the unused msg_lang duplicate
- add a web-docs i18n build script and its CI workflow, plus tests for the pushover notification channel

web/app/[locale]/docs/post-install/security/page.tsx

@@ -47,6 +47,7 @@ export default async function PostInstallSecurityPage({
       <DocHeader
         title={t("header.title")}
         section={t("header.section")}
+        estimatedMinutes={5}
       />
 
       <Callout variant="info" title={t("intro.title")}>
@@ -72,9 +73,8 @@ export default async function PostInstallSecurityPage({
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("rpcbind.runsTitle")}</h3>
       <CopyableCode
-        code={`# Stop and disable the rpcbind service
-systemctl stop rpcbind
-systemctl disable rpcbind`}
+        code={`# Stop and disable both activation paths
+systemctl disable --now rpcbind.socket rpcbind.service`}
         className="my-4"
       />
       <p className="mb-4 text-gray-800 leading-relaxed">{t("rpcbind.runsOutro")}</p>
@@ -84,14 +84,14 @@ systemctl disable rpcbind`}
         {t.rich("rpcbind.verifyBody", { code })}
       </p>
       <CopyableCode
-        code={`systemctl is-active rpcbind       # should report: inactive
-systemctl is-enabled rpcbind      # should report: disabled
+        code={`systemctl is-active rpcbind.service rpcbind.socket
+systemctl is-enabled rpcbind.service rpcbind.socket
 ss -tulpn | grep ':111 '          # should return nothing`}
         className="my-4"
       />
 
-      <Callout variant="tip" title={t("rpcbind.reversibleTitle")}>
-        {t.rich("rpcbind.reversibleBody", { em, link: uninstallLink })}
+      <Callout variant="warning" title={t("rpcbind.reversibleTitle")}>
+        {t.rich("rpcbind.reversibleBody", { em, strong, code, link: uninstallLink })}
       </Callout>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("related.heading")}</h2>