fix: contact delete by pubkey, cache contacts as pending, cache delete button

1. Delete button now sends public_key instead of name to avoid matching
   wrong contacts when multiple share similar names.
2. _on_advertisement adds cache-only contacts to mc.pending_contacts when
   manual approval is enabled, so they appear in the pending list after
   advertising (even if meshcore fires ADVERTISEMENT instead of NEW_CONTACT).
3. Added Delete button for cache-only contacts with dedicated
   /api/contacts/cached/delete endpoint and hard_delete_contact DB method.
4. approve_contact/reject_contact now handle DB-only pending contacts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/meshcore/cli.py

@@ -224,6 +224,19 @@ def delete_contact(selector: str) -> Tuple[bool, str]:
         return False, str(e)
 
 
+def delete_cached_contact(public_key: str) -> Tuple[bool, str]:
+    """Hard-delete a cache-only contact from the database."""
+    if not public_key or not public_key.strip():
+        return False, "Public key is required"
+
+    try:
+        dm = _get_dm()
+        result = dm.delete_cached_contact(public_key.strip())
+        return result['success'], result.get('message', result.get('error', ''))
+    except Exception as e:
+        return False, str(e)
+
+
 def clean_inactive_contacts(hours: int = 48) -> Tuple[bool, str]:
     """Remove contacts inactive for specified hours. Simplified in v2."""
     # TODO: implement time-based cleanup via database query