feat(ocr): support tenant-scoped sandbox document erasure

[Sam123ben]

Goal

Provide a durable, tenant-scoped sandbox document erasure API so DevAI can manually remove uploaded test documents before the existing 24-hour lifecycle rule.

Acceptance criteria

• authenticated product and tenant scope is enforced with 404 for foreign resources
• deletion is idempotent and cancels active durable OCR work first
• source, page, result and quarantine artifacts are erased without exposing object locators
• CNPG state retains only safe audit/tombstone metadata needed for idempotency and 24-hour lifecycle reporting
• no raw document content, storage URL or credential is returned or logged
• contract, tenant-isolation and retry tests cover the workflow

Related: DevAI sandbox result-details UI.

[Sam123ben]

Reviewed deletion design

Manual sandbox deletion is a durable asynchronous operation, not a UI-only reset. The API will accept DELETE /v1/ocr/uploads/{upload_id} only under the verified product/tenant identity and return an opaque receipt. The CNPG transaction marks the upload for erasure, asks cancellation of any active OCR job through the existing outbox, and schedules the existing scope dispatcher.

The eraser will run only after all associated workflows are terminal. It will delete the quarantine upload, non-shared accepted source, page artifacts and result artifact with bounded retries; a retry after a partial cloud-storage failure is safe because object deletion is idempotent. It then removes operational metadata and retains an RLS-protected, content-free tombstone for idempotency. Reads are denied as soon as erasure is requested, cache entries are evicted, and no locator, file text, signed URL or credential crosses the API boundary.

Important review finding: promoted source objects are content-addressed and can be shared by equivalent uploads in one product/tenant. The eraser must retain a source while another non-deleted upload references it; it must never blindly delete every source locator.