multi-user: users, per-user profiles/filters/notifications, tab UI, apply forensics

* DB: users + user_profiles/filters/notifications/preferences; applications gets
  user_id + forensics_json + profile_snapshot_json; new errors table
  with 14d retention; schema versioning via MIGRATIONS list
* auth: password hashes in DB (argon2); env vars seed first admin; per-user
  sessions; CSRF bound to user id
* apply: personal info/WBS moved out of env into the request body; providers
  take an ApplyContext with Profile + submit_forms; full Playwright recorder
  (step log, console, page errors, network, screenshots, final HTML)
* web: five top-level tabs (Wohnungen/Bewerbungen/Logs/Fehler/Einstellungen);
  settings sub-tabs profil/filter/benachrichtigungen/account/benutzer;
  per-user matching, auto-apply and notifications (UI/Telegram/SMTP); red
  auto-apply switch on Wohnungen tab; forensics detail view for bewerbungen
  and fehler; retention background thread

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/logs.html

@@ -0,0 +1,23 @@
+{% extends "_layout.html" %}
+{% block title %}Logs — lazyflat{% endblock %}
+{% block content %}
+<section class="card">
+    <div class="px-4 py-3 border-b border-soft"><h2 class="font-semibold">Meine Aktionen (Audit-Log)</h2></div>
+    <div class="divide-y divide-soft">
+        {% for e in events %}
+        <div class="px-4 py-2 mono">
+            <span class="text-slate-500">{{ e.timestamp }}</span>
+            <span class="text-slate-400">{{ e.actor }}</span>
+            <span class="text-slate-700">{{ e.action }}</span>
+            {% if e.details %}<span class="text-slate-500">— {{ e.details }}</span>{% endif %}
+            {% if e.ip %}<span class="text-slate-400"> [{{ e.ip }}]</span>{% endif %}
+        </div>
+        {% else %}
+        <div class="px-4 py-8 text-center text-slate-500">Keine Log-Einträge.</div>
+        {% endfor %}
+    </div>
+    <div class="px-4 py-3 border-t border-soft text-xs text-slate-500">
+        Einträge werden nach 14 Tagen automatisch gelöscht.
+    </div>
+</section>
+{% endblock %}