Permanently delete multiple files in a single request.

Authorization (applied to every file in the request):

• Visibility: file must be accessible to the user → 404 if any are not found
• Delete permission: user must have the right to delete each file → 403 if any are denied
• Workspace type: workspace must not be sync-managed → 400 if any are synced

Public datasets: instance admins (MANAGE_PUBLIC_DATASET) can bulk-delete public-dataset files. A workspace-scoped API key with read-only access to a public dataset can see the file (so it counts toward visibility) but gets 403 on the delete-permission check — public datasets are read-only for opted-in companies.

Returns 204 (No Content) on success.