multi-user: users, per-user profiles/filters/notifications, tab UI, apply forensics

* DB: users + user_profiles/filters/notifications/preferences; applications gets
  user_id + forensics_json + profile_snapshot_json; new errors table
  with 14d retention; schema versioning via MIGRATIONS list
* auth: password hashes in DB (argon2); env vars seed first admin; per-user
  sessions; CSRF bound to user id
* apply: personal info/WBS moved out of env into the request body; providers
  take an ApplyContext with Profile + submit_forms; full Playwright recorder
  (step log, console, page errors, network, screenshots, final HTML)
* web: five top-level tabs (Wohnungen/Bewerbungen/Logs/Fehler/Einstellungen);
  settings sub-tabs profil/filter/benachrichtigungen/account/benutzer;
  per-user matching, auto-apply and notifications (UI/Telegram/SMTP); red
  auto-apply switch on Wohnungen tab; forensics detail view for bewerbungen
  and fehler; retention background thread

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/bewerbungen.html

@@ -0,0 +1,32 @@
+{% extends "_layout.html" %}
+{% block title %}Bewerbungen — lazyflat{% endblock %}
+{% block content %}
+<section class="card">
+    <div class="flex items-center justify-between px-4 py-3 border-b border-soft">
+        <h2 class="font-semibold">Meine Bewerbungen</h2>
+        <span class="text-xs text-slate-500">{{ applications|length }}</span>
+    </div>
+    <div class="divide-y divide-soft">
+        {% for a in applications %}
+        <div class="px-4 py-3 text-sm">
+            <div class="flex items-center gap-2 flex-wrap">
+                {% if a.success == 1 %}<span class="chip chip-ok">ok</span>
+                {% elif a.success == 0 %}<span class="chip chip-bad">fail</span>
+                {% else %}<span class="chip chip-warn">läuft</span>{% endif %}
+                <span class="chip chip-info">{{ a.triggered_by }}</span>
+                {% if a.provider %}<span class="chip chip-info">{{ a.provider }}</span>{% endif %}
+                {% if a.submit_forms_used %}<span class="chip chip-warn">echt gesendet</span>
+                {% else %}<span class="chip chip-info">dry-run</span>{% endif %}
+                <span class="text-slate-500 text-xs ml-auto">{{ a.started_at }}</span>
+            </div>
+            <div class="mt-1 truncate">
+                <a href="/bewerbungen/{{ a.id }}">#{{ a.id }} — {{ a.address or a.url }}</a>
+            </div>
+            {% if a.message %}<div class="text-xs text-slate-500 mt-0.5 truncate">{{ a.message }}</div>{% endif %}
+        </div>
+        {% else %}
+        <div class="px-4 py-8 text-center text-slate-500">Noch keine Bewerbungen.</div>
+        {% endfor %}
+    </div>
+</section>
+{% endblock %}