Delete a site

Owner only — an admin may edit the site but not delete it — and it really deletes: the site plus its goals, hostnames, blocklists and import jobs, with its ClickHouse data removed asynchronously. An admin or a member gets 403 not_site_owner — there is no API equivalent of the dashboard's "remove my access". Every deletion is first recorded in an off-database journal so that a restore from backup cannot bring the site back; when that journal cannot be written the deletion is refused with 503 deletion_unavailable and nothing is deleted — retry later.