Server UI: broken CSS, alert() notices, logout cookies not cleared

[nesvet]

Summary

Several UX and maintainability issues in the v0.2.2 web UI make error recovery awkward and hide useful server context from operators.

Problems

1. Invalid inline CSS — tokens such as #margin and #float in HTML (likely meant as comments) are ignored by browsers.
2. alert() for notices — server notice messages block the UI thread and do not fit multi-step connect flows.
3. Logout — deleteAllCookies() exists but the Logout link does not call it.
4. Connect DOM — replacing the form via innerHTML makes it hard to show errors and retry without a full page reload.
5. Multi-host deployments — no way to show which BMC or label the user selected when several hosts share one reverse proxy (full_hostname / display labels not surfaced in the UI).

UI refactor goals

Minimal first change set (WebSocket protocol unchanged):

• Extract static/app.core.css and static/app.core.js.
• Status banner + session log instead of alert().
• Keep the connect form in the DOM; create the noVNC iframe via the DOM API.
• Wire logout to cookie cleanup.
• Pass version=__version__ for cache busting and server_labels (and host identity) for multi-host display in main.py.

Optional follow-up PR for layout polish (app.ui.*).

Tested on ASUS ASMB8-iKVM firmware 1.14.2: wrong-password errors appear in the banner; multi-host labels render when configured.