fix(dashboard): hover infobulles, full-width layout, UX polish

- Fix doc tooltips: split CSS into <style type='text/tailwindcss'> for
  @apply directives + raw CSS for reliable doc panel rendering
- Convert doc panels from click-toggle to hover-based infobulles with
  arrow pointer, fade-in animation, and auto-dismiss on mobile
- Replace '?' icons with 'ⓘ' across all 11 templates (51 tooltips)
- Full-width layout: reduce padding on mobile (px-3), scale up on
  desktop (lg:px-5, xl:px-6) for maximum screen utilization
- Auto-collapse sidebar on narrow screens (<1024px)
- Keyboard shortcuts: Alt+1–9 for page navigation, Alt+B toggle sidebar
- Add LEGITIMATE_BROWSER filter button to detections page
- Sticky header with stronger blur (backdrop-blur-md)
- All 46 routes pass tests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/templates/ip_detail.html

@@ -31,7 +31,7 @@
     <div class="grid grid-cols-1 lg:grid-cols-2 gap-4">
         <div class="section-card">
             <div class="section-header"><span class="section-title">Profil comportemental
-                <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+                <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                     <h4>Radar comportemental</h4>
                     <p>Compare cette IP aux profils moyens ISP (vert) et datacenter/bot (rouge). Les axes sont normalisés 0→1.</p>
                     <p><strong>Interprétation :</strong> Un profil proche du rouge indique un comportement bot. hit_velocity élevé + fuzzing élevé = scraping agressif.</p>
@@ -42,7 +42,7 @@
         </div>
         <div class="section-card">
             <div class="section-header"><span class="section-title">Scores ML dans le temps
-                <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+                <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                     <h4>Historique des scores</h4>
                     <p>Évolution du score ML normalisé sur les derniers cycles. Un score stable élevé = bot persistant. Un pic soudain = changement de comportement.</p>
                     <p class="doc-source">Source : ml_all_scores</p>
@@ -55,7 +55,7 @@
     <!-- Detections -->
     <div class="section-card overflow-hidden">
         <div class="section-header"><span class="section-title">Détections
-            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                 <h4>Historique des détections</h4>
                 <p>Chaque ligne = une session classée comme anormale. Le score combiné utilise l'ensemble triple-voix (EIF + AE + XGBoost).</p>
                 <p class="doc-source">Source : ml_detected_anomalies</p>
@@ -71,7 +71,7 @@
     <!-- AI Features grid -->
     <div class="section-card overflow-hidden" id="features-section" style="display:none">
         <div class="section-header"><span class="section-title">Features AI (dernière fenêtre)
-            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                 <h4>Features ML détaillées</h4>
                 <p>72 features extraites : velocity, fuzzing, entropie, ratios, métriques TLS, etc. Valeurs élevées en rouge indiquent un comportement suspect.</p>
                 <p class="doc-source">Source : view_ai_features_1h</p>
@@ -83,7 +83,7 @@
     <!-- HTTP Logs -->
     <div class="section-card overflow-hidden">
         <div class="section-header"><span class="section-title">Requêtes HTTP récentes (100 max)
-            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                 <h4>Logs HTTP bruts</h4>
                 <p>Dernières requêtes de cette IP. Cherchez des patterns : scraping séquentiel, POST répétés, paths suspects, absence de referer.</p>
                 <p class="doc-source">Source : http_logs</p>
@@ -99,7 +99,7 @@
     <!-- Resource cascade -->
     <div class="section-card overflow-hidden" id="cascade-section" style="display:none">
         <div class="section-header"><span class="section-title">Cascade de ressources
-            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">?</button><div class="doc-panel">
+            <span class="relative inline-block"><button onclick="docToggle(this)" class="doc-btn">ⓘ</button><div class="doc-panel">
                 <h4>Analyse de cascade</h4>
                 <p>Détection de navigateurs headless : un vrai navigateur charge une page HTML puis ses sous-ressources (CSS, JS, images) avec un délai croissant. Un bot ne charge souvent que la page principale.</p>
                 <p><strong>Indicateurs :</strong> page_count=1 + max_sub=0 = bot probable. avg_sub_delay très bas = headless rapide.</p>