map: clickable address + status chip + Bewerben/Ablehnen in Leaflet popups

- map_points payload now carries flat id, per-user status, can_apply, is_running
- Popup titles link to the listing; status chip mirrors the list (beworben /
  läuft… / fehlgeschlagen); Bewerben + Ablehnen submit via the same HTMX
  endpoints as the list, re-swapping #wohnungen-body
- csrf token rides on the script[data-csrf] sibling of #flats-map
- popupopen → htmx.process(popupEl) so hx-* on freshly injected DOM binds
- site-style .map-popup-* CSS hooked into Leaflet's popup wrapper

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/base.html

@@ -82,6 +82,17 @@
         body:has(#v_map:checked) .view-list { display: none; }
         body:has(#v_map:checked) .view-map { display: block; }
         #flats-map { height: 520px; border-radius: 10px; }
+
+        /* Leaflet popup — match site visual */
+        .leaflet-popup-content-wrapper { border-radius: 12px; box-shadow: 0 6px 20px rgba(16,37,63,.15); }
+        .leaflet-popup-content { margin: 12px 14px; min-width: 220px; color: var(--text); }
+        .map-popup-title { font-weight: 600; font-size: 13px; display: inline-block; color: var(--primary); }
+        .map-popup-title:hover { text-decoration: underline; }
+        .map-popup-meta { color: var(--muted); font-size: 12px; margin-top: 2px; }
+        .map-popup-status { margin-top: 8px; }
+        .map-popup-actions { display: flex; gap: 6px; margin-top: 10px; flex-wrap: wrap; }
+        .map-popup-actions .btn { padding: 0.35rem 0.7rem; font-size: 12px; }
+        .map-popup-actions form { margin: 0; }
         .brand-dot {
             width: 2rem; height: 2rem; border-radius: 10px;
             background: linear-gradient(135deg, #66b7f2 0%, #2f8ae0 60%, #fbd76b 100%);