Delete Attachment

Soft-delete an attachment uploaded by the caller.

The bytes drop from the user's quota immediately. Physical cleanup of the file is deferred to a janitor pass that checks no other active row references the same storage_path (the dedup hash means a deleted row might still leave the bytes in use for someone else).

Only the uploader can delete. An attached message stays valid — the recipient sees a "this image was removed" placeholder via the existing 404 fallback on the serve endpoint. We don't cascade-delete the message because the sender might have meant to delete just the photo, not the whole conversation turn.

Idempotent: deleting an already-deleted attachment returns 204.