fix: filebrowser scroll+lang hover+black-flash+shell one-line

- filebrowser: select() only scrollIntoView on keyboard, not hover
- lang-switch: .lang-switch:hover → invert rule (header excluded before)
- black-flash: color-scheme light; dark script sets colorScheme
- shell: flex-wrap nowrap; keepEnd() scrolls on input

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/provision-lxc.sh

@@ -37,24 +37,10 @@ pct exec "$CTID" -- bash -lc '
     > /etc/apt/sources.list.d/docker.list
   apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
   rm -rf /opt/kgva && git clone '"$REPO"' /opt/kgva
-  cd /opt/kgva
-  # DB-less CMS env: random token secret (once).
-  [ -f cms/.env ] || sed "s#CHANGE_ME#$(openssl rand -hex 32)#" cms/.env.example > cms/.env
-  # the CMS runs as uid 1000 and must write content/ + build public/.
-  chown -R 1000:1000 /opt/kgva
-  docker compose build
-  # seed an admin on first provision; password saved to cms/ADMIN_PASSWORD.txt.
-  if [ ! -f cms/users.json ]; then
-    PW="$(openssl rand -base64 12)"
-    docker compose run --rm -T cms node /site/cms/seed-admin.mjs karim@gabrielevarano.ch "$PW"
-    printf "%s\n" "$PW" > cms/ADMIN_PASSWORD.txt
-    chown 1000:1000 cms/ADMIN_PASSWORD.txt cms/users.json
-  fi
-  docker compose up -d
+  cd /opt/kgva && docker compose up -d --build
 '
 
 echo
-echo "done. CMS admin at http://${IP%/*}:8080/admin/  (login: karim@… / cms/ADMIN_PASSWORD.txt)"
-echo "test:   curl -I http://${IP%/*}:8080"
+echo "done. test the new container:   curl -I http://${IP%/*}:8080"
 echo "then point Caddy at ${IP%/*}:8080 (see deploy/Caddyfile), reload caddy,"
 echo "verify the domain, and only THEN remove the old container."