Harden forward-auth, per-user isolation, and budget accuracy

Code-review fixes on the Authentik/budget/Resend work:

- UpsertForwardUser: avoid 500 lockout on username UNIQUE collision and
  on the concurrent first-login race; normalize emails (lower+trim) so
  case variants don't create duplicate accounts.
- Centralize email management in Authentik: when forward-auth mode is on,
  email is read-only in Veola for every user (not just forward rows);
  pure-local deployments keep editable email for Resend.
- Fail closed on per-user isolation: ownedItem rejects uid==0/orphaned
  items; dashboard and global results error on a userless request.
- Budget accuracy: count Apify usage only after a successful run, and
  count the billed Test Apify run.
- Efficiency: resolve the deal-email recipient once per poll; build the
  settings page once in PostEmailPrefs.

templates/settings.templ

@@ -31,6 +31,10 @@ type SettingsData struct {
 	UserError      string
 	EmailMsg       string
 	EmailError     string
+	// ForwardAuthMode is true when the deployment delegates identity to
+	// Authentik (forward-auth). Email is then managed centrally in Authentik
+	// and read-only in Veola for every user.
+	ForwardAuthMode bool
 }
 
 // ApifyMonthCost is the estimated month-to-date Apify spend.
@@ -302,11 +306,12 @@ func currentWeeklyDigest(d SettingsData) bool {
 	return d.CurrentUser != nil && d.CurrentUser.EmailWeeklyDigest
 }
 
-// emailManagedExternally reports whether the signed-in user's email comes from
-// an identity provider (Authentik forward-auth) and so is read-only here. The
-// address is the IdP match key; letting them edit it would orphan the row.
+// emailManagedExternally reports whether email is owned by Authentik and so is
+// read-only in Veola. True for any user when the deployment runs in forward-auth
+// mode (email is centralized in Authentik), and for an individual forward row
+// regardless of mode (the address is its IdP match key).
 func emailManagedExternally(d SettingsData) bool {
-	return d.CurrentUser != nil && d.CurrentUser.AuthSource == "forward"
+	return d.ForwardAuthMode || (d.CurrentUser != nil && d.CurrentUser.AuthSource == "forward")
 }
 
 templ Settings(d SettingsData) {