fix(panel): GUI defects from the 1.2.x layout pass (P3)

- .flash.error now renders on the danger surface instead of the success
  one; RateLimitErr previously showed as green with red text.
- User delete goes through a confirmation page (GET/POST
  /users/{uid}/delete), matching the domain-delete pattern, instead of a
  plain submit button next to Save with no confirmation.
- Extracted the repeated DNS Host/Type/Value markup on a domain's page and
  the duplicated Settings credentials form into shared partials. No
  behaviour change.

docs/plans/code-review.md P3 checked off; CHANGELOG updated.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/web.go

@@ -166,6 +166,8 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("POST /users/new", h.HandleUserNew)
 	authed.HandleFunc("GET /users/{uid}", h.HandleUserEdit)
 	authed.HandleFunc("POST /users/{uid}", h.HandleUserEdit)
+	authed.HandleFunc("GET /users/{uid}/delete", h.HandleUserDeleteConfirm)
+	authed.HandleFunc("POST /users/{uid}/delete", h.HandleUserDelete)
 
 	authed.HandleFunc("GET /backup", h.HandleBackupPage)
 	authed.HandleFunc("POST /backup", h.HandleBackup)