Clean up flash key legacy code and extract import.php inline styles

App::consumeFlash() had 18-line legacy fallback chains reading from seven old
session keys (error, admin_error, edit_error, form_error, success,
admin_success, edit_success) that were written by no code in the codebase.
All action handlers have used App::flash() -> _flash_error / _flash_success
since the App class was introduced. Removed the dead fallbacks; consumeFlash()
is now 4 lines.

admin/import.php was the last admin template with inline style= attributes.
Extracted four of them to named CSS classes in admin.css:
- admin-error-list   — error <ul> spacing (was style="margin:.5rem 0 0;padding-left:1.2rem")
- admin-file-hint    — <small> display + margin (was style="margin-top:.5rem")
- admin-import-results        — results panel margin (was style="margin-top:2rem")
- admin-import-results__title — <h2> typography (was multi-property inline style)

Closes the 'unify flash message keys' item in todo/02-php-components.md and
the import.php inline style item in todo/01-css-semantic-refactor.md.

src/App.php

@@ -106,36 +106,14 @@ class App
     /**
      * Consume and return flash messages, then clear them from the session.
      *
-     * Also drains the legacy per-page keys (error, success, admin_error,
-     * admin_success, edit_error, edit_success, form_error) so the transition
-     * to unified keys can happen incrementally.
-     *
      * @return array{error: ?string, success: ?string}
      */
     public static function consumeFlash(): array
     {
-        // Unified keys first, fall back to any legacy key that is set.
-        $error = $_SESSION['_flash_error']
-            ?? $_SESSION['error']
-            ?? $_SESSION['admin_error']
-            ?? $_SESSION['edit_error']
-            ?? $_SESSION['form_error']
-            ?? null;
+        $error   = $_SESSION['_flash_error']   ?? null;
+        $success = $_SESSION['_flash_success'] ?? null;
 
-        $success = $_SESSION['_flash_success']
-            ?? $_SESSION['success']
-            ?? $_SESSION['admin_success']
-            ?? $_SESSION['edit_success']
-            ?? null;
-
-        // Clear all variants.
-        unset(
-            $_SESSION['_flash_error'],  $_SESSION['_flash_success'],
-            $_SESSION['error'],         $_SESSION['success'],
-            $_SESSION['admin_error'],   $_SESSION['admin_success'],
-            $_SESSION['edit_error'],    $_SESSION['edit_success'],
-            $_SESSION['form_error']
-        );
+        unset($_SESSION['_flash_error'], $_SESSION['_flash_success']);
 
         // Note: autofocus is consumed separately via consumeAutofocus().
         return ['error' => $error, 'success' => $success];