Brand-derived danger color + alert_dialog confirmation on destructive admin actions

#22 in Riparion/riparion-cms — merged 2026-05-31

Summary

Two related admin/theming improvements on this branch:

1. Derive the destructive red from the accent hue — --primary-error-color (delete buttons, invalid-input borders) now tracks --danger-hue, which leans with --brand-hue inside the red band, so destructive UI stays in sync when the accent is retuned instead of reading as a fixed stranger red.

2. Confirm every destructive admin action via the catalog alert_dialog — no admin delete fires without an explicit confirmation modal:

   • The shared ActionButton (src/pages/admin/mod.rs) gains an optional confirm: Option<String> prop that gates the mutation behind an AlertDialog. Posts, comments, and taxonomy (category/tag) deletes pass it; non-destructive actions (approve/reject) stay immediate.
   • Media deletes use a dedicated MediaDeleteButton (src/pages/admin/media.rs) that replaces the old window.confirm() JS eval — it always prompts and, for in-use images, lazily fetches and lists the posts that would be left with a broken image.
   • Installs the alert_dialog catalog widget (src/components/alert_dialog/).

Test plan

• cargo clippy clean on both targets (server --features server,sqlite; wasm --features web)
• cargo fmt --check passes
• dx serve, sign into admin, and confirm each delete (Posts / Comments / Taxonomy / Media) opens a confirmation dialog and only deletes on confirm; media confirmation lists referencing posts for in-use images

🤖 Generated with Claude Code