v0.5.0: Trash (soft-delete) + Keep folder

Delete now moves an artifact to a recoverable Trash instead of hard-removing.

- Model: Artifact.deleted_at (nullable, indexed) = in Trash.
- Soft-delete everywhere: DELETE /api/artifacts/{id} sets deleted_at
  (idempotent 204); session POST /a/{id}/delete for the feed's hover Delete
  icon; POST /a/{id}/undelete restores; POST /feed/empty-trash purges.
- Trashed artifacts are off-quota (deleting frees quota) and eviction-protected
  (never evicted early); hidden from feed, sources, counts, and all API reads
  (list/detail/raw).
- Sidebar: "Deleted" and "Keep" system folders at the bottom (counts, hidden
  when empty); ?folder=deleted / ?folder=keep views reuse the row rendering.
  Deleted view has hover Undelete + an Empty Trash button. Keep = view over
  is_kept. Live-poll disabled in folder views.
- Docs (api.md delete section, CLAUDE.md), 10 new/updated tests. 150 passing;
  API soft-delete lifecycle verified live.

Purge is manual (Empty Trash) this release; auto purge-on-delete (background,
~3-day retention) is the planned fast-follow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

artifacts/urls.py

@@ -10,6 +10,9 @@ urlpatterns = [
     path("a/<str:artifact_id>/read", views.mark_artifact_read, name="artifact-mark-read"),
     path("a/<str:artifact_id>/keep", views.toggle_artifact_keep, name="artifact-toggle-keep"),
     path("a/<str:artifact_id>/share", views.toggle_artifact_share, name="artifact-toggle-share"),
+    path("a/<str:artifact_id>/delete", views.delete_artifact, name="artifact-delete"),
+    path("a/<str:artifact_id>/undelete", views.undelete_artifact, name="artifact-undelete"),
+    path("feed/empty-trash", views.empty_trash, name="feed-empty-trash"),
     path("a/<str:artifact_id>", views.artifact_view, name="artifact"),
     path("s/<str:share_token>", views.shared_artifact_view, name="artifact-shared"),
     path("assets/<str:asset_id>", views.asset_view, name="asset"),