Permanently delete a survey and (via ON DELETE CASCADE) its targets + responses.

PREVIEW BY DEFAULT. Without ?confirm=true this reports what the delete would destroy and changes nothing. The count matters because the CASCADE is invisible from the call site: the request says "delete survey 8" and the FK quietly takes every answer anyone ever gave it. On 2026-08-08 we reconstructed 19 deleted responses across resets and survey deletions, and the only signal left was a row counter — no record of whose answers they were.

"The UI confirms" was the old safeguard, and it isn't one: the endpoint is called from curl and from agents far more often than from the UI, and neither sees that dialog.