fix(panel): GUI defects from the 1.2.x layout pass (P3)

- .flash.error now renders on the danger surface instead of the success
  one; RateLimitErr previously showed as green with red text.
- User delete goes through a confirmation page (GET/POST
  /users/{uid}/delete), matching the domain-delete pattern, instead of a
  plain submit button next to Save with no confirmation.
- Extracted the repeated DNS Host/Type/Value markup on a domain's page and
  the duplicated Settings credentials form into shared partials. No
  behaviour change.

docs/plans/code-review.md P3 checked off; CHANGELOG updated.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/view/templates/user_delete.html

@@ -0,0 +1,16 @@
+{{define "content"}}
+<h1>Delete {{.TargetUsername}}</h1>
+
+{{template "back_link" (back (printf "/users/%d" .TargetID) (printf "Back to %s" .TargetUsername))}}
+
+<div class="card narrow">
+  <h2>Confirm deletion</h2>
+  <p>You are about to delete the panel user <strong>{{.TargetUsername}}</strong>.
+  This cannot be undone; a signed-in session for this user stops working
+  immediately.</p>
+
+  <form method="post" action="/users/{{.TargetID}}/delete">
+    <button type="submit" class="danger">Delete {{.TargetUsername}}</button>
+  </form>
+</div>
+{{end}}