Hard delete applications, nest installer packages, detect PE versions

Soft delete left orphaned executables on disk and let a deleted name collide
with a fresh import, so delete is now a hard delete that removes the
associated files. The destructive paths (delete, revert-to-record) require a
typed OK because neither can be undone.

Installers keep their filename at import and nest per application/version,
which stops repeat imports doubling up. Version now comes from the same PE
detection the endpoints agent uses; when no version can be read the caller is
asked for one rather than silently storing a blank.

Applications also surface Version and a monitorable toggle, with launch path
and process name required only while monitorable is ticked. Fleet shows the
PC alias, matching PC Details.

frontend/src/api/index.js

@@ -762,8 +762,16 @@ export const applicationsApi = {
   update(id, data) {
     return api.put(`/applications/${id}`, data)
   },
-  delete(id) {
-    return api.delete(`/applications/${id}`)
+  // Hard delete. The backend requires the operator's typed confirmation in the
+  // body, so the caller must pass what the user actually typed - this is not
+  // defaulted here, or the guard would be meaningless.
+  delete(id, confirm) {
+    return api.delete(`/applications/${id}`, { data: { confirm } })
+  },
+  // Strips policies, versions and uploaded executables but keeps the catalogue
+  // row and its image. Same typed-confirmation contract as delete.
+  revertToRecord(id, confirm) {
+    return api.post(`/applications/${id}/revert`, { confirm })
   },
   // multipart image upload; backend sets image to the served URL
   uploadImage(id, file) {