Ask before deleting, and put the row actions on icons

Muokkaa and Poista become a pencil and a bin, which stops the catalog rows
being two words wide. Both carry a Finnish aria-label and title, so nothing
is lost by dropping the text.

An icon is easier to hit by accident than a word, so neither delete happens
immediately now. A tapped bin turns that row's actions into "Poista? Kyllä /
Peruuta", and a logged meal asks "Poistetaanko merkintä?" before it goes.
The meal is the more destructive of the two: a dish is only soft-deleted and
its name still resolves in old entries, while the log row is dropped outright.

Both confirmations are plain links and forms, so they work with the back
button and need no client code.

Also fixes a test that was passing for the wrong reason. The delete check only
asserted a 303 and took the first dish id on the page, which stopped being the
one it had just created when the catalog became grouped and alphabetical — so
it was deleting an unrelated dish. It now finds that dish's own id, and a new
refute helper asserts the dish is actually gone afterwards.

scripts/smoke.sh

@@ -43,6 +43,16 @@ check() {
 	fi
 }
 
+# refute <name> <haystack> <needle>
+refute() {
+	if printf '%s' "$2" | grep -qF -- "$3"; then
+		echo "  FAIL  $1 (should not contain: $3)"
+		fail=1
+	else
+		echo "  ok    $1"
+	fi
+}
+
 echo "smoke: http://$addr"
 
 check "unauthenticated request is refused" \
@@ -125,6 +135,11 @@ check "the saved day shows what was eaten" \
 check "history is on the same page as the logger" \
 	"$(curl -s -u ":$pass" "http://$addr/")" "Aiemmin"
 
+# Deleting a logged meal drops the row outright, so it asks first.
+saved=$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05&poista=1")
+check "deleting a meal asks first" "$saved" "Poistetaanko merkintä?"
+refute "and does not delete while asking" "$saved" "Ei merkintää"
+
 check "deleting redirects back" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
 		-d "pvm=2026-09-05" "http://$addr/poista")" "303"
@@ -196,14 +211,31 @@ check "adding a side redirects" \
 check "the new side is listed" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Lohkoperunat"
 
-uusi=$(printf '%s' "$catalog" | grep -o 'muokkaa=[0-9]*' | head -n1 | cut -d= -f2)
+# The id of Uunikala specifically: the catalog is grouped and alphabetical, so
+# the first id on the page belongs to some other dish entirely.
+uusi=$(printf '%s' "$catalog" | grep -o 'Uunikala.*' | grep -o 'muokkaa=[0-9]*' | head -n1 | cut -d= -f2)
+if [ -z "$uusi" ]; then
+	echo "  FAIL  could not find Uunikala's id in the catalog"
+	fail=1
+	uusi=0
+fi
 check "the edit form is prefilled" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat?muokkaa=$uusi")" "Muokkaa pääruokaa"
 
-check "deleting a main redirects" \
+# A bin icon is easy to hit by accident, so the row asks before anything goes.
+check "the bin asks before deleting" \
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Poista?"
+
+check "the dish is still there while it asks" \
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Uunikala"
+
+check "confirming the delete redirects" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
 		-d "id=$uusi&tyyppi=paa" "http://$addr/ruuat/poista")" "303"
 
+refute "the dish is gone once confirmed" \
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Uunikala"
+
 if [ "$fail" -ne 0 ]; then
 	echo "smoke: FAILED"
 	exit 1