multi-user: users, per-user profiles/filters/notifications, tab UI, apply forensics

* DB: users + user_profiles/filters/notifications/preferences; applications gets
  user_id + forensics_json + profile_snapshot_json; new errors table
  with 14d retention; schema versioning via MIGRATIONS list
* auth: password hashes in DB (argon2); env vars seed first admin; per-user
  sessions; CSRF bound to user id
* apply: personal info/WBS moved out of env into the request body; providers
  take an ApplyContext with Profile + submit_forms; full Playwright recorder
  (step log, console, page errors, network, screenshots, final HTML)
* web: five top-level tabs (Wohnungen/Bewerbungen/Logs/Fehler/Einstellungen);
  settings sub-tabs profil/filter/benachrichtigungen/account/benutzer;
  per-user matching, auto-apply and notifications (UI/Telegram/SMTP); red
  auto-apply switch on Wohnungen tab; forensics detail view for bewerbungen
  and fehler; retention background thread

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -19,12 +19,17 @@ services:
       - SESSION_MAX_AGE_SECONDS=${SESSION_MAX_AGE_SECONDS:-604800}
       - LOGIN_RATE_LIMIT=${LOGIN_RATE_LIMIT:-5}
       - LOGIN_RATE_WINDOW_SECONDS=${LOGIN_RATE_WINDOW_SECONDS:-900}
-      - FILTER_ROOMS=${FILTER_ROOMS:-2.0,2.5}
-      - FILTER_MAX_RENT=${FILTER_MAX_RENT:-1500}
-      - FILTER_MAX_MORNING_COMMUTE=${FILTER_MAX_MORNING_COMMUTE:-50}
+      - RETENTION_DAYS=${RETENTION_DAYS:-14}
+      - RETENTION_RUN_INTERVAL_SECONDS=${RETENTION_RUN_INTERVAL_SECONDS:-3600}
+      - PUBLIC_URL=${PUBLIC_URL:-https://flat.lab.moritz.run}
+      - SMTP_HOST=${SMTP_HOST:-}
+      - SMTP_PORT=${SMTP_PORT:-587}
+      - SMTP_USERNAME=${SMTP_USERNAME:-}
+      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
+      - SMTP_FROM=${SMTP_FROM:-lazyflat@localhost}
+      - SMTP_STARTTLS=${SMTP_STARTTLS:-true}
     volumes:
       - lazyflat_data:/data
-    # Coolify assigns the public port/domain via labels — no host port needed.
     expose:
       - "8000"
 
@@ -32,36 +37,15 @@ services:
     build: ./apply
     container_name: lazyflat-apply
     restart: unless-stopped
-    # Intentionally NOT exposed to the internet. Reachable only on the compose network.
     expose:
       - "8000"
     environment:
       - INTERNAL_API_KEY=${INTERNAL_API_KEY}
       - HEADLESS=true
-      - SUBMIT_FORMS=${SUBMIT_FORMS:-False}
-      - LANGUAGE=${LANGUAGE:-de}
       - BROWSER_WIDTH=${BROWSER_WIDTH:-600}
       - BROWSER_HEIGHT=${BROWSER_HEIGHT:-800}
       - BROWSER_LOCALE=${BROWSER_LOCALE:-de-DE}
       - POST_SUBMISSION_SLEEP_MS=${POST_SUBMISSION_SLEEP_MS:-0}
-      - SALUTATION=${SALUTATION}
-      - LASTNAME=${LASTNAME}
-      - FIRSTNAME=${FIRSTNAME}
-      - EMAIL=${EMAIL}
-      - TELEPHONE=${TELEPHONE}
-      - STREET=${STREET}
-      - HOUSE_NUMBER=${HOUSE_NUMBER}
-      - POSTCODE=${POSTCODE}
-      - CITY=${CITY}
-      - IS_POSSESSING_WBS=${IS_POSSESSING_WBS:-False}
-      - WBS_TYPE=${WBS_TYPE:-0}
-      - WBS_VALID_TILL=${WBS_VALID_TILL:-1970-01-01}
-      - WBS_ROOMS=${WBS_ROOMS:-0}
-      - WBS_ADULTS=${WBS_ADULTS:-0}
-      - WBS_CHILDREN=${WBS_CHILDREN:-0}
-      - IS_PRIO_WBS=${IS_PRIO_WBS:-False}
-      - IMMOMIO_EMAIL=${IMMOMIO_EMAIL:-}
-      - IMMOMIO_PASSWORD=${IMMOMIO_PASSWORD:-}
 
   alert:
     build: ./alert