Delete one trace's stored content

The content plane's deletion: one transaction tombstones the control row, nulls the manifest and the content-derived title, writes the trace_content_delete audit row, and enqueues the physical object deletions — so the commit IS the deletion, every read is structure-only from that moment, and the bytes follow within the executor's retry budget. Permanent: a late-arriving part for a deleted trace is refused, and re-approval does not resurrect it. The trace's STRUCTURE — the timeline, counts, costs — is untouched, deliberately. Allowed to the trace's creator and to a holder of the account's settings_manage; the user_id in the path must be the creator, so an admin deleting on someone's behalf addresses the trace under that person.