(ui) Clarify run action flows

Move run cancellation and review actions out of the page header into
dedicated action panels with clearer operator copy and consistent form
button styling.

Refs #25

src/pobsync_backend/templates/pobsync_backend/host_detail.html

@@ -433,7 +433,7 @@
         </div>
       {% endfor %}
 
-      <div class="actions">
+      <div class="form-actions">
         <button type="submit" {% if not can_queue_dry_run and not can_queue_real_backup %}disabled{% endif %}>Queue with options</button>
       </div>
     </form>

src/pobsync_backend/templates/pobsync_backend/run_detail.html

@@ -11,20 +11,6 @@
     </div>
     <section class="actions" aria-label="Run actions">
       <a class="button-link" href="{% url 'host_detail' run.host.host %}">Back to host</a>
-      {% if can_cancel %}
-        <form method="post" action="{% url 'cancel_run' run.id %}">
-          {% csrf_token %}
-          <button type="submit" class="secondary">Cancel run</button>
-        </form>
-      {% endif %}
-      {% if run.status == "failed" or run.status == "warning" %}
-        {% if not run.reviewed_at %}
-          <form method="post" action="{% url 'resolve_run_review' run.id %}">
-            {% csrf_token %}
-            <button type="submit" class="secondary">Mark reviewed</button>
-          </form>
-        {% endif %}
-      {% endif %}
     </section>
   </header>
 
@@ -35,6 +21,22 @@
     <div class="metric"><div class="label">Rsync</div><div class="value">{{ run.rsync_exit_code|default:"" }}</div></div>
   </section>
 
+  {% if can_cancel %}
+    <section class="panel highlight warning">
+      <h2>Run Control</h2>
+      <p>
+        Cancelling a queued run stops it immediately. Cancelling a running run asks the worker to stop
+        and records the cancellation request on this run.
+      </p>
+      <form method="post" action="{% url 'cancel_run' run.id %}">
+        {% csrf_token %}
+        <div class="form-actions">
+          <button type="submit" class="danger">Cancel run</button>
+        </div>
+      </form>
+    </section>
+  {% endif %}
+
   {% if failure %}
     <section class="panel highlight failed">
       <h2>Failure</h2>
@@ -46,6 +48,21 @@
     </section>
   {% endif %}
 
+  {% if run.status == "failed" or run.status == "warning" %}
+    {% if not run.reviewed_at %}
+      <section class="panel highlight warning">
+        <h2>Review Required</h2>
+        <p>Mark this run as reviewed after you have checked the failure or warning and no longer need it in the action queue.</p>
+        <form method="post" action="{% url 'resolve_run_review' run.id %}">
+          {% csrf_token %}
+          <div class="form-actions">
+            <button type="submit" class="secondary">Mark reviewed</button>
+          </div>
+        </form>
+      </section>
+    {% endif %}
+  {% endif %}
+
   {% if run.reviewed_at %}
     <section class="panel highlight success">
       <h2>Review</h2>

src/pobsync_backend/tests/test_views.py

@@ -1667,8 +1667,11 @@ class ViewTests(TestCase):
         response = self.client.get(reverse("run_detail", args=[run.id]))
 
         self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Run Control")
+        self.assertContains(response, "Cancelling a queued run stops it immediately")
         self.assertContains(response, "Cancel run")
         self.assertContains(response, reverse("cancel_run", args=[run.id]))
+        self.assertContains(response, 'class="danger"', html=False)
 
     def test_run_detail_renders_worker_execution_metadata(self) -> None:
         self.client.force_login(self.staff_user)