dashboard: destructive actions execute without confirmation

Several destructive dashboard actions execute on the first click, bypassing the typed-confirm convention the dashboard otherwise follows.

Missing confirmation entirely

• packages/ui/pages/server/ssh-keys.stx:82 — @click="removeKey(k.name)" fires DELETE /api/ssh-keys immediately. Removing the wrong key can lock the owner out of the box.
• packages/ui/pages/server/actions.stx (runServerCmd) and packages/ui/pages/serverless.stx:95 (runAppCmd) — the free-form command boxes run on Enter or a single click with no confirmation. Note server/actions.stx:76 states "Mutating commands require typed confirmation", but the runner directly below it does not.

Both runners also hardcode the confirm token in the request body ({ command, confirm: 'run' }), so any server-side confirm gate is satisfied unconditionally by the client. (These endpoints are admin-only — box:shell — so this is an operator foot-gun rather than a privilege issue.)

Confirmed but weak

server/backups.stx:60 restore replaces the live database, but the token is the literal word restore — the same word on the button.

Suggested fix

Route all of the above through the shared partials/op-confirm.stx bar, with the resource name as the token, and stop sending a client-side confirm value for the command endpoints.