fix(delete): review follow-ups — admin Deleted filter, guest gate, dialog spacing

- Admin /users gains a Deleted scope (between People and Robots); every other scope now
  hides tombstoned accounts (deleted_at filter in UserFilter).
- Admin delete-user is offered for any non-deleted account (drop the not-guest gate, so a
  stale is_guest account can still be tombstoned).
- Harden EmailService.ConfirmCode to ClearGuest — defence-in-depth so no confirmed-email
  path leaves is_guest set (the currently-live paths already do).
- Space the delete/change dialog's action row from its input field.
Integration tests: the Deleted filter scoping + ConfirmCode guest promotion.

ui/src/screens/Profile.svelte

@@ -644,6 +644,12 @@
     display: flex;
     gap: 8px;
   }
+  /* When a button row sits below its own field (the change-email and delete dialogs),
+     separate them and keep the actions right-aligned. */
+  .addrow.end {
+    margin-top: 14px;
+    justify-content: flex-end;
+  }
   .addrow input {
     flex: 1;
     min-width: 0;