map: clickable address + status chip + Bewerben/Ablehnen in Leaflet popups

- map_points payload now carries flat id, per-user status, can_apply, is_running
- Popup titles link to the listing; status chip mirrors the list (beworben /
  läuft… / fehlgeschlagen); Bewerben + Ablehnen submit via the same HTMX
  endpoints as the list, re-swapping #wohnungen-body
- csrf token rides on the script[data-csrf] sibling of #flats-map
- popupopen → htmx.process(popupEl) so hx-* on freshly injected DOM binds
- site-style .map-popup-* CSS hooked into Leaflet's popup wrapper

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/app.py

@@ -412,13 +412,28 @@ def _wohnungen_context(user) -> dict:
         f = item["row"]
         if f["lat"] is None or f["lng"] is None:
             continue
+        last = item["last"]
+        is_running = bool(last and last["finished_at"] is None)
+        already_applied = bool(last and last["success"] == 1)
+        if is_running:
+            status = {"label": "läuft…", "chip": "warn"}
+        elif already_applied:
+            status = {"label": "beworben", "chip": "ok"}
+        elif last and last["success"] == 0:
+            status = {"label": "fehlgeschlagen", "chip": "bad"}
+        else:
+            status = None
         map_points.append({
+            "id": f["id"],
             "lat": f["lat"], "lng": f["lng"],
             "address": f["address"] or f["link"],
             "link": f["link"],
             "rent": f["total_rent"],
             "rooms": f["rooms"],
             "size": f["size"],
+            "status": status,
+            "can_apply": allowed and not already_applied,
+            "is_running": is_running,
         })
     return {
         "flats": flats_view,