Remove one wrap

Deletes a single wrap. Wraps tied to a passkey are also removed when that passkey is deleted. Removing the last wrap of a client_tss key makes the key unrecoverable — the vault holds only its own share.

Owner only, and needs X-Auth-Confirm: a single-use re-auth token from POST /v1/auth/reauth/complete with purpose tss.key.wrap_delete, or the account password. Strong factor: once a passkey (usable on this domain) or TOTP is enrolled, the confirmation must use one of them and a password is refused. Audited client_share.deleted.