fix(panel): GUI defects from the 1.2.x layout pass (P3)

- .flash.error now renders on the danger surface instead of the success
  one; RateLimitErr previously showed as green with red text.
- User delete goes through a confirmation page (GET/POST
  /users/{uid}/delete), matching the domain-delete pattern, instead of a
  plain submit button next to Save with no confirmation.
- Extracted the repeated DNS Host/Type/Value markup on a domain's page and
  the duplicated Settings credentials form into shared partials. No
  behaviour change.

docs/plans/code-review.md P3 checked off; CHANGELOG updated.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -545,11 +545,12 @@ roles, and security.md no longer calls the panel single-user.
 
 **Model: Sonnet.**
 
-- [ ] `.flash.error` (or stop using `.flash` for `RateLimitErr`) — danger
+- [x] `.flash.error` (or stop using `.flash` for `RateLimitErr`) — danger
       surface, not success.
-- [ ] User delete: `data-confirm` at minimum; prefer a confirm page like
-      domain delete.
-- [ ] DNS field partial; settings credentials partial.
+- [x] User delete: `data-confirm` at minimum; prefer a confirm page like
+      domain delete. Done as a confirm page (`GET/POST /users/{uid}/delete`),
+      matching `domain_delete.html`.
+- [x] DNS field partial; settings credentials partial.
 - [ ] Optional: `urlquery` on deliveries fragment params; `aria-live` on
       polled regions; confirm-without-JS note next to the CSRF accepted risks.