Harden forward-auth, per-user isolation, and budget accuracy

Code-review fixes on the Authentik/budget/Resend work:

- UpsertForwardUser: avoid 500 lockout on username UNIQUE collision and
  on the concurrent first-login race; normalize emails (lower+trim) so
  case variants don't create duplicate accounts.
- Centralize email management in Authentik: when forward-auth mode is on,
  email is read-only in Veola for every user (not just forward rows);
  pure-local deployments keep editable email for Resend.
- Fail closed on per-user isolation: ownedItem rejects uid==0/orphaned
  items; dashboard and global results error on a userless request.
- Budget accuracy: count Apify usage only after a successful run, and
  count the billed Test Apify run.
- Efficiency: resolve the deal-email recipient once per poll; build the
  settings page once in PostEmailPrefs.

internal/handlers/items.go

@@ -28,7 +28,10 @@ func (a *App) ownedItem(r *http.Request, id int64) (*models.Item, error) {
 	if err != nil {
 		return nil, err
 	}
-	if it == nil || it.UserID != a.userID(r) {
+	// Fail closed: a zero uid (no authenticated user) must never match, and an
+	// orphaned item (UserID 0) must never be treated as owned-by-default.
+	uid := a.userID(r)
+	if it == nil || uid == 0 || it.UserID != uid {
 		return nil, nil
 	}
 	return it, nil