v2.0.1 — collab-attachments size cap + oumta overview tiles

- relay: raise /api/collab-attachments + /api/attachments/upload POST
  size limit from 256KB to 15MB, matching /api/attachments. Previous
  limit silently dropped any collab image >~100KB as 413 (envelope
  overhead pushes even modest JPEGs past the cap), leaving puller
  clients with broken <img src="uploads/..."> references.
- oumta-dashboard: centre overview tiles, bump value font to 56px,
  introduce .oumta-fail alarm state that paints the full tile red with
  white text. Toggled from JS for cluster state=down, workloads down
  >0, and open incidents >0. Fail colour uses --t-danger so it stays
  in sync with the "unavailable" workload labels.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

public/plugins/oumta-dashboard/oumta-dashboard.js

@@ -269,19 +269,28 @@ function renderOverview() {
     if (!o) return;
 
     // Values that come directly from the Go overview endpoint [REAL].
-    $('oumta-cluster-card').dataset.state = o.clusterState || 'unknown';
-    $('oumta-cluster-state').textContent  = o.clusterState || 'unknown';
+    const clusterCard = $('oumta-cluster-card');
+    const clusterState = o.clusterState || 'unknown';
+    clusterCard.dataset.state = clusterState;
+    clusterCard.classList.toggle('oumta-fail', clusterState === 'down');
+    $('oumta-cluster-state').textContent  = clusterState;
     $('oumta-cluster-updated').textContent = o.updatedAtUtc ? 'as of ' + formatTime(o.updatedAtUtc) : 'no data';
     $('oumta-workloads-up').textContent    = o.workloadsUp   ?? '—';
     $('oumta-workloads-down').textContent  = o.workloadsDown ?? '—';
     $('oumta-last-import').textContent     = o.updatedAtUtc ? formatTime(o.updatedAtUtc) : '—';
 
+    // Any workload down → the "workloads down" tile becomes an alarm tile.
+    const downCard = $('oumta-workloads-down').closest('.oumta-card');
+    if (downCard) downCard.classList.toggle('oumta-fail', (o.workloadsDown ?? 0) > 0);
+
     // Values derived client-side from the workloads list — the overview
     // endpoint doesn't carry these today. If the backend later adds
     // `incidents` / `attention` fields, prefer those over the derivation.
     const attention = wl.filter(w => w.state !== 'healthy')
         .sort((a, b) => rankState(a.state) - rankState(b.state));
     $('oumta-incidents').textContent = attention.length || '—';
+    const incCard = $('oumta-incidents').closest('.oumta-card');
+    if (incCard) incCard.classList.toggle('oumta-fail', attention.length > 0);
 
     const list = $('oumta-attention-list');
     if (!attention.length) {