PRD-025 — preview or execute source-purge-first support-message erasure

Preview or erase local support rows for one normalized sender email.

Dry-run is the default. Execute mode is schema-gated on three independent operator confirmations: the source mailbox was already purged, the email was repeated exactly after normalization, and the expected local row count matches at execution time. Sync and erasure share a PostgreSQL transaction lock, closing the in-flight-sync re-import race.

The audit row is fail-closed and atomic with deletion. It identifies the admin by user_id but deliberately omits every email, message id, subject, and body; detail contains action/counts only. The response is counts-only. This endpoint remains available when SUPPORT_INBOX_ENABLED is off so a privacy request is never blocked by an ingestion feature flag.