Delete Custom Disposition

CONTACTS NOBODY. Deletes one of the organisation's CUSTOM dispositions.

The gap voice_router named as deliberately absent - "voice's own dispositions router never exposed a delete endpoint" - which is no longer true: it does, and this publishes it.

REFUSED WITH 409 IF ANY CALL IS ALREADY DISPOSITIONED WITH IT. So this only ever removes an unused value - history cannot be rewritten by it, and a 409 means "this one is in use", not "try again".

The organisation is carried in a HEADER, not the path, and voice resolves the row with it (_load_disposition_for_org). It is the key's own org, so one tenant cannot delete another's vocabulary by guessing an id.

ADMIN ONLY, and that gate is declared HERE. Voice declares require_org_admin() on its own route, and for a server-to-server call that dependency finds no bearer token and - with ENFORCE_VOICE_PERMISSIONS off, which is everywhere today - ALLOWS the request. require_org_admin from developer_api.dependencies.admin is the one actually protecting this, and it refuses machine keys outright: deleting shared org vocabulary needs a personal key held by an Admin or Owner.