refine post-install and hardware GPU docs, Monitor UX and CLI styling

- rewrite the 15 post-install pages and the 3 hardware GPU pages so they reflect the current scripts (reversibility, tracked-tool counts, kernel parameters, per-tool commands, Alpine LXC propagation flow)
- migrate the legacy step-badge helper on post-install/optional and create-vm/synology to the canonical pill component, with the stepLabel key added in each locale
- fix rich-text i18n calls missing helpers across network, automated, optional, security, customization and the post-install landing pages, and escape the `<iface>` placeholder in automated so intl no longer parses it as a tag
- remove the mouse-follow blue overlay from the docs landing layout
- reposition the App-tab Edit button and stack the Search and Register controls vertically on mobile
- move the Bulk update Configure/Edit control into the section header so it behaves the same on desktop and mobile
- show a spinner during the final autoremove/autoclean pass of update-pve-safe so the cleanup step reads as active instead of silent
- restyle the shell spinner and msg_info in a distinctive purple and drop the unused msg_lang duplicate
- add a web-docs i18n build script and its CI workflow, plus tests for the pushover notification channel

web/messages/en/docs/post-install/security.json

@@ -23,11 +23,11 @@
     "nfsTitle": "Don't disable this if you use NFS",
     "nfsBody": "NFS server <strong>and</strong> NFS client rely on <code>rpcbind</code> to negotiate the ports used by <code>mountd</code>, <code>statd</code>, <code>lockd</code>, etc. If your Proxmox host either <em>exports</em> NFS shares to other machines or <em>mounts</em> NFS shares from a NAS, do not apply this option. Mounts will fail with <code>mount.nfs: rpc.statd is not running</code> or similar.",
     "runsTitle": "What ProxMenux runs",
-    "runsOutro": "The package stays installed (so you or another tool can re-enable it later). The service unit is disabled so the service does not come back on reboot.",
+    "runsOutro": "The package stays installed. ProxMenux records the original enabled/active state of both rpcbind.service and rpcbind.socket, then disables and stops both units so socket activation cannot bring the service back.",
     "verifyTitle": "Verification",
     "verifyBody": "After applying, confirm <code>rpcbind</code> is off and nothing is listening on port 111:",
-    "reversibleTitle": "Reversible from the Uninstall menu",
-    "reversibleBody": "This change is tracked. Open <link>Uninstall Optimizations</link> and pick <em>RPC Disable</em> to restore it. Nothing is purged from the system — just re-enable the service and it starts again."
+    "reversibleTitle": "Restores the original service state",
+    "reversibleBody": "This change is registered in <code>installed_tools.json</code>. <link>Uninstall Optimizations</link> restores each rpcbind unit to the enabled/disabled and active/inactive state captured before ProxMenux changed it; it does not assume that rpcbind was enabled on every host."
   },
   "related": {
     "heading": "Related",