Add a Delete action to the applications list and withdraw the app policy

The Applications page had no delete control even though the endpoint and
the API client both already existed, so the gap was UI-only.

The button is gated on applications.delete via hasPermission rather than
on the admin role, mirroring the backend guard: admins bypass it anyway,
and a non-admin role granted the permission should get the button instead
of a control that would only 403.

Deleting also withdraws the generated install policy. Delete here is a
soft delete, and the policy is a separate row that did not follow, so a
deactivated application kept installing itself across the fleet with
nothing on screen to explain why. A customised policy is still left
alone, on the same ownership terms as unticking the box.

plugins/applications/frontend/views/ApplicationsList.vue

@@ -73,6 +73,13 @@
                   >
                     View
                   </router-link>
+                  <button
+                    v-if="candelete"
+                    class="btn btn-danger btn-sm"
+                    @click="deleteApplication(app)"
+                  >
+                    Delete
+                  </button>
                 </td>
               </tr>
               <tr v-if="applications.length === 0">
@@ -98,14 +105,21 @@
 </template>
 
 <script setup>
-import { ref, onMounted } from 'vue'
+import { ref, computed, onMounted } from 'vue'
 import { applicationsApi } from '@/api'
+import { useAuthStore } from '@/stores/auth'
 import PaginationBar from '@/components/PaginationBar.vue'
 import { useListQuery } from '@/composables/listQuery'
 import { fileHref } from '@/utils/basePath'
 
 const applications = ref([])
 const loading = ref(true)
+
+// Mirrors the backend guard on the endpoint rather than checking for the admin
+// role, so a non-admin role granted applications.delete gets the button too and
+// nobody is shown a control that would only 403.
+const authStore = useAuthStore()
+const candelete = computed(() => authStore.hasPermission('applications.delete'))
 const { page, search, setPage, setSearch } = useListQuery({ onChange: loadApplications })
 const filter = ref('installable')
 const totalPages = ref(1)
@@ -164,6 +178,27 @@ function debouncedSearch() {
   }, 300)
 }
 
+// The server deactivates rather than drops the row, so this is reversible and
+// the prompt does not claim otherwise. It does warn about the fleet-wide
+// consequence, which is the part that is not obvious from a Delete button.
+async function deleteApplication(app) {
+  const warning = app.isrequired
+    ? `\n\n"${app.appname}" is currently required on all PCs. Removing it also `
+      + 'withdraws the policy that installs it.'
+    : ''
+
+  if (!confirm(`Remove "${app.appname}" from the catalogue?${warning}`)) return
+
+  try {
+    await applicationsApi.delete(app.appid)
+    loadApplications()
+  } catch (error) {
+    console.error('Error deleting application:', error)
+    alert(error.response?.data?.data?.error?.message
+      || 'Failed to remove the application.')
+  }
+}
+
 function goToPage(p) {
   setPage(p)
   loadApplications()