feat: withdraw a deleted QSO from QRZ.com and Club Log

Opt-in, off by default: neither service can undo it, and a local delete is not
always a statement about the world — a duplicate cleared out of a contest log
was never meant to change the DX's log.

The two APIs are not alike, and the difference decides what is possible:

  - Club Log deletes by MATCH (callsign, exact timestamp, band number), so it
    works for every QSO in the log, past or future. The band table is its own
    list and is pinned by a test: a band mapped to the wrong number does not
    fail, it points the delete at a different QSO.
  - QRZ.com deletes ONLY by logid. So markExtUploaded now stores the LOGID it
    already received on every upload — it was being logged and thrown away. A
    QSO uploaded before this cannot be withdrawn from here at all, and the log
    says so by name rather than leaving the operator to assume it worked.

Both run BEFORE the local delete, because both need the QSO's own fields to
find their copy and there is nothing left to ask with once the row is gone.
Neither can block it: the operator asked for the QSO to go, and a refusing
website is not a reason to keep it.

internal/extsvc/extsvc.go

@@ -128,6 +128,13 @@ type ExternalServices struct {
 	HRDLog   ServiceConfig `json:"hrdlog"`
 	EQSL     ServiceConfig `json:"eqsl"`
 	Cloudlog ServiceConfig `json:"cloudlog"`
+
+	// DeleteRemote asks OpsLog to withdraw a QSO from QRZ.com and Club Log when
+	// it is deleted locally. Off unless the operator turns it on: neither
+	// service can undo it, and a local delete is not always meant to reach the
+	// world — a duplicate cleared from a contest log was never meant to be a
+	// statement about the DX's log.
+	DeleteRemote bool `json:"delete_remote"`
 }
 
 // UploadResult is the outcome of a single upload attempt.