Add a Delete action to the applications list and withdraw the app policy

The Applications page had no delete control even though the endpoint and
the API client both already existed, so the gap was UI-only.

The button is gated on applications.delete via hasPermission rather than
on the admin role, mirroring the backend guard: admins bypass it anyway,
and a non-admin role granted the permission should get the button instead
of a control that would only 403.

Deleting also withdraws the generated install policy. Delete here is a
soft delete, and the policy is a separate row that did not follow, so a
deactivated application kept installing itself across the fleet with
nothing on screen to explain why. A customised policy is still left
alone, on the same ownership terms as unticking the box.

shopdb/core/api/applications.py

@@ -411,6 +411,13 @@ def delete_application(app_id: int):
 
     app.isactive = False
 
+    # Withdraw the generated policy too. Deactivating an application while its
+    # policy still runs would keep installing something the catalogue says is
+    # gone, and nothing in the UI would explain why. A customised policy is
+    # left alone, same as unticking the box.
+    app.isrequired = False
+    _sync_required_app_policy(app)
+
     AuditLog.log('deleted', 'Application', entityid=app.appid, entityname=app.appname)
 
     db.session.commit()