settings: relabel dry-run, harder PM block, rework users page

- Bewerbungen chip "Trockenmodus" → "nicht abgeschickt" (list + detail view)
- Profile form: add an off-screen honeypot (username + password) so Chrome's
  autofill burns its fill on those instead of the real E-Mail field; switch
  the visible E-Mail and Immomio-Email to type=text + inputmode=email so the
  browser heuristic no longer tags them as login emails
- Users page: create-form sits on top in its own card (3-column grid with
  Administrator checkbox inline); full-width list below with Administrator
  chip, aktiv/deaktiviert chip, "du" marker for the current user, plus
  disable/activate and a new red "löschen" button (confirm prompt) wired to
  new POST /actions/users/delete which cascades through the user's data

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/db.py

@@ -304,6 +304,14 @@ def set_user_disabled(user_id: int, disabled: bool) -> None:
         )
 
 
+def delete_user(user_id: int) -> None:
+    """Remove a user and everything that cascades (profile, filters, notifications,
+    preferences, rejections, applications). Audit/error logs stay (user_id column
+    is nullable)."""
+    with _lock:
+        _conn.execute("DELETE FROM users WHERE id = ?", (user_id,))
+
+
 # ---------------------------------------------------------------------------
 # User profile / filters / notifications / preferences
 # ---------------------------------------------------------------------------