app.api.delete: accept the (url, data, callback) form formAJAX uses; defer the login-card reveal to DOM ready

formAJAX always passes the serialized form as the second argument, so a
DELETE-method form (the host/DNS delete buttons) landed its callback in
the data slot and never ran.

The login page's "reveal the card once we know you're logged out" branch
touched an element further down the same page, which threw when
isLoggedIn answered before the parser got there (it always did without a
stored token). It now runs on DOM ready.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nodejs/public/lib/js/app-base.js

@@ -129,7 +129,14 @@ app.api = (function(app){
 		return body('PUT', url, data, callback);
 	}
 
-	function remove(url, callback){
+	// Called both as (url, callback) and — from formAJAX, which always passes
+	// the serialized form as the second argument — as (url, data, callback).
+	// No request body is sent either way.
+	function remove(url, data, callback){
+		if(typeof data === 'function'){
+			callback = data;
+			data = undefined;
+		}
 		if(typeof callback !== 'function'){
 			return new Promise(function(resolve, reject){
 				$.ajax({