fix: contact delete by pubkey, cache contacts as pending, cache delete button

1. Delete button now sends public_key instead of name to avoid matching
   wrong contacts when multiple share similar names.
2. _on_advertisement adds cache-only contacts to mc.pending_contacts when
   manual approval is enabled, so they appear in the pending list after
   advertising (even if meshcore fires ADVERTISEMENT instead of NEW_CONTACT).
3. Added Delete button for cache-only contacts with dedicated
   /api/contacts/cached/delete endpoint and hard_delete_contact DB method.
4. approve_contact/reject_contact now handle DB-only pending contacts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/database.py

@@ -163,6 +163,15 @@ class Database:
             )
             return cursor.rowcount > 0
 
+    def hard_delete_contact(self, public_key: str) -> bool:
+        """Permanently delete a contact from the database."""
+        with self._connect() as conn:
+            cursor = conn.execute(
+                "DELETE FROM contacts WHERE public_key = ?",
+                (public_key.lower(),)
+            )
+            return cursor.rowcount > 0
+
     def downgrade_stale_device_contacts(self, active_device_keys: set) -> int:
         """Downgrade contacts marked 'device' that are no longer on the device."""
         with self._connect() as conn: