IT Assets: make GDPR Mask function discoverable from users list

- Users list: add eye-slash icon button per unmasked row (editor+ only)
  clicking opens a compact confirmation modal inline in the list
- User detail: gate Edit / Assign / Mask buttons behind is_editor check
  (button was shown to all but route already blocked readonly users)

IT_asset_management/app/templates/users/detail.html

@@ -14,7 +14,7 @@
     {% if user.is_masked %}<span class="badge badge-masked fs-6 align-middle ms-2">MASKED</span>{% endif %}
   </h1>
   <div class="d-flex gap-2">
-    {% if not user.is_masked %}
+    {% if not user.is_masked and current_user.is_editor %}
     <a href="{{ url_for('users.edit', user_id=user.id) }}" class="btn btn-sm btn-outline-primary">
       <i class="bi bi-pencil me-1"></i>Edit
     </a>

IT_asset_management/app/templates/users/index.html

@@ -83,6 +83,37 @@
             <a href="{{ url_for('users.detail', user_id=u.id) }}" class="btn btn-sm btn-outline-secondary py-0 px-2">
               <i class="bi bi-eye"></i>
             </a>
+            {% if not u.is_masked and current_user.is_editor %}
+            <button class="btn btn-sm btn-outline-danger py-0 px-2 ms-1"
+                    title="GDPR Mask — permanently erase PII"
+                    data-bs-toggle="modal"
+                    data-bs-target="#maskModal{{ u.id }}">
+              <i class="bi bi-eye-slash"></i>
+            </button>
+            <!-- Mask modal for list row -->
+            <div class="modal fade" id="maskModal{{ u.id }}" tabindex="-1">
+              <div class="modal-dialog modal-sm">
+                <div class="modal-content">
+                  <div class="modal-header border-0 pb-0">
+                    <h6 class="modal-title text-danger"><i class="bi bi-eye-slash me-1"></i>Mask User</h6>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+                  </div>
+                  <div class="modal-body">
+                    <p class="mb-1">Permanently erase all PII for <strong>{{ u.display_name }}</strong>?</p>
+                    <p class="small text-muted mb-0">Name, email and phone will be replaced with <em>[MASKED]</em>. Windows ID and asset history are kept. <strong>Cannot be undone.</strong></p>
+                  </div>
+                  <div class="modal-footer border-0 pt-0">
+                    <button type="button" class="btn btn-sm btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <form method="POST" action="{{ url_for('users.mask', user_id=u.id) }}" class="d-inline">
+                      <button type="submit" class="btn btn-sm btn-danger">
+                        <i class="bi bi-eye-slash me-1"></i>Confirm
+                      </button>
+                    </form>
+                  </div>
+                </div>
+              </div>
+            </div>
+            {% endif %}
           </td>
         </tr>
         {% else %}