feat(kernel): module/source cleanup, tab layout, Limine auto-update, beta label

- Add /lib/modules cleanup: scan orphaned module dirs, show size,
  checkbox-select and remove with approval (kernel_modules_clean)
- Add /usr/src source cleanup: checkbox-select inactive source dirs,
  show size via du -sb, remove with approval (kernel_src_clean);
  protect active symlink target from deletion
- Extend _kernel_status() to include modules list and size per src_dir
- Replace 8 kernel accordions with 4-tab layout (Overview / Sources /
  Bootloader / Build) with two-column grids for desktop; Build tab
  shows a pip dot when wizard is active
- Sources tab: /usr/src dirs full-width on top, Portage and kernel.org
  side-by-side below
- Add Limine bootloader auto-update wizard step (kernel_limine_config_auto_update):
  clones running entry, substitutes new kver in paths, inserts before
  first linux entry, creates timestamped backup
- Fix default-entry dropdown: use x-effect + selectedIndex to avoid
  Alpine CSP x-for value-attribute timing bug; @change reads
  selectedIndex so number (not full label text) is stored
- Mark kernel section as beta: nav label, in-page notice banner, README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gorecodes

README.md

@@ -441,6 +441,7 @@ Overlay add is disabled by default. To enable it, set `ARBOR_ENABLE_OVERLAY_ADD=
 - **Portage News** — reads GLEP 42 news items from the local tree, tracks read state per-item, shows an unread count badge on the dashboard
 - **GLSA advisories** — lists security advisories that affect the installed system via `glsa-check`, with severity badges, affected packages, and a quick-fix button
 - **Config snapshot** — export `/etc/portage/` (including the `make.profile` symlink) and world files as a zip; import with an automatic timestamped backup of the current config before applying
+- **Kernel management** *(beta)* — full lifecycle wizard for source kernels: install or update via Portage with pretend preview and autounmask support; download vanilla kernels directly from kernel.org; browse and clean up `/usr/src/linux-*` source directories; switch the active symlink; 7-step manual build wizard (kernel config with optional `.config` copy from another source, `make modules_install`, `make install`, dracut initramfs generation, `@module-rebuild`, Limine bootloader auto-update); manage bootloaders including a Limine config editor; clean up old `/boot` files and orphaned `/lib/modules` directories; reboot with double confirmation (type `REBOOT` + approval); wizard state persisted in the browser across page reloads and reconnects to in-progress build jobs after refresh. Functional but not yet fully stabilized — always keep a working fallback kernel in your bootloader.
 - **Jobs** — view active jobs, reopen live output, browse persisted history with log viewing, delete, and purge actions (stored in SQLite at `/var/lib/arbor/history.db`), and surface recovered orphaned/unknown jobs after daemon restart
 
 ## Screenshots

backend/arbor/action_security.py

@@ -40,13 +40,20 @@
     "eclean_pretend",
     "snapshot_export",
     "disk_usage",
+    "kernel_status",
+    "kernel_available",
+    "limine_config_read",
 }
 
 _PRETEND_COMMANDS = {
     "emerge_pretend",
     "emerge_uninstall_pretend",
     "emerge_depclean_pretend",
     "revdep_rebuild_pretend",
+    "kernel_install_pretend",
+    "kernel_oldconfig",
+    "kernel_switch_src",
+    "kernel_copy_config",
 }
 
 _APPROVAL_REQUIRED_COMMANDS = {
@@ -63,6 +70,21 @@
     "eclean_run",
     "snapshot_import",
     "revdep_rebuild",
+    "kernel_install",
+    "kernel_bootloader_update",
+    "kernel_boot_clean",
+    "kernel_modules_clean",
+    "kernel_src_clean",
+    "kernel_olddefconfig",
+    "kernel_build",
+    "kernel_modules_install",
+    "kernel_make_install",
+    "kernel_initramfs",
+    "kernel_module_rebuild",
+    "kernel_download_tarball",
+    "kernel_reboot",
+    "limine_config_write",
+    "limine_config_auto_update",
 }
 
 _TARGET_KEYS = ("atom", "name", "cfg_file", "job_id")

backend/arbor/authorization.py

@@ -75,6 +75,28 @@ class StepUpRequiredError(PermissionError):
     "revdep_rebuild_pretend",
     "revdep_rebuild",
     "disk_usage",
+    "kernel_status",
+    "kernel_available",
+    "kernel_install_pretend",
+    "kernel_install",
+    "kernel_bootloader_update",
+    "kernel_boot_clean",
+    "kernel_modules_clean",
+    "kernel_src_clean",
+    "kernel_oldconfig",
+    "kernel_olddefconfig",
+    "kernel_build",
+    "kernel_initramfs",
+    "kernel_module_rebuild",
+    "kernel_download_tarball",
+    "kernel_reboot",
+    "kernel_switch_src",
+    "kernel_copy_config",
+    "kernel_modules_install",
+    "kernel_make_install",
+    "limine_config_read",
+    "limine_config_write",
+    "limine_config_auto_update",
 }
 
 _ROLE_ALLOWED_CLASSES = {