map: clickable address + status chip + Bewerben/Ablehnen in Leaflet popups

- map_points payload now carries flat id, per-user status, can_apply, is_running
- Popup titles link to the listing; status chip mirrors the list (beworben /
  läuft… / fehlgeschlagen); Bewerben + Ablehnen submit via the same HTMX
  endpoints as the list, re-swapping #wohnungen-body
- csrf token rides on the script[data-csrf] sibling of #flats-map
- popupopen → htmx.process(popupEl) so hx-* on freshly injected DOM binds
- site-style .map-popup-* CSS hooked into Leaflet's popup wrapper

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/_wohnungen_body.html

@@ -102,7 +102,7 @@
         <div id="flats-map" hx-preserve="true"></div>
     </div>
 </section>
-<script id="flats-map-data" type="application/json">{{ map_points | tojson }}</script>
+<script id="flats-map-data" type="application/json" data-csrf="{{ csrf }}">{{ map_points | tojson }}</script>
 
 <!-- Liste -->
 <section class="view-list card">