#244: mode marked — flag profile-violating configuration in the UI

Every catalog-listed control on the admin surfaces carries an accessible
deviation marking in mode marked: text + icon under the control (never
colour alone), part of the control's accessible description
(aria-describedby), i18n de+en. The check runs against the CURRENT
control value, so a violating choice is marked before saving. Covered
controls: registration mode, new-page classification, upload policy,
SVG policy, the four master switches (api/mcp/feeds/plugins), the legal
texts (violating while empty), and the Nextcloud backup toggle on the
system panel. The profile card (#243) gains the warning summary and the
hardening-guide reference. e2e: new vs-nfd-marking pack (marked half in
CI — the e2e api now runs VS_NFD_MODE=marked, which also puts the
marked state into the a11y admin scan; off half in local default runs;
both halves verified live). hidden/enforced follow in #245/#246.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

.gitea/workflows/ci.yml

@@ -620,6 +620,13 @@ jobs:
           E2E_BASE_URL=http://localhost:5173 E2E_VS_NFD_MODE=marked \
             pnpm --filter @dorfteich/web exec playwright test e2e/vs-nfd-marking.spec.ts
 
+      # The marking pack's extra login on top of the six a11y logins pushes
+      # the theme pack over the 10/min login limit — reset again (#244).
+      - name: Reset login rate limit before theme pack
+        run: |
+          echo "DELETE FROM rate_limits WHERE key LIKE 'login%';" | \
+            pnpm --filter @dorfteich/api exec prisma db execute --stdin --url "$DATABASE_URL"
+
       # Hell/Dunkel/System-Umschalter (issue #180).
       - name: Run theme pack
         run: |