v0.5.0: Trash (soft-delete) + Keep folder

Delete now moves an artifact to a recoverable Trash instead of hard-removing.

- Model: Artifact.deleted_at (nullable, indexed) = in Trash.
- Soft-delete everywhere: DELETE /api/artifacts/{id} sets deleted_at
  (idempotent 204); session POST /a/{id}/delete for the feed's hover Delete
  icon; POST /a/{id}/undelete restores; POST /feed/empty-trash purges.
- Trashed artifacts are off-quota (deleting frees quota) and eviction-protected
  (never evicted early); hidden from feed, sources, counts, and all API reads
  (list/detail/raw).
- Sidebar: "Deleted" and "Keep" system folders at the bottom (counts, hidden
  when empty); ?folder=deleted / ?folder=keep views reuse the row rendering.
  Deleted view has hover Undelete + an Empty Trash button. Keep = view over
  is_kept. Live-poll disabled in folder views.
- Docs (api.md delete section, CLAUDE.md), 10 new/updated tests. 150 passing;
  API soft-delete lifecycle verified live.

Purge is manual (Empty Trash) this release; auto purge-on-delete (background,
~3-day retention) is the planned fast-follow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/api.md

@@ -452,11 +452,15 @@ DELETE /api/artifacts/{id}
 Authorization: Bearer <your-personal-token>
 ```
 
-Removes the artifact's database row and its files (primary file, markdown
-sidecar, and any attached assets). Returns `204` with no body on success.
+**Soft-delete:** moves the artifact to Trash rather than removing it — it's
+recoverable (from the app's "Deleted" folder), becomes off-quota, and is hidden
+from all API reads (`GET /api/artifacts`, the detail, and `…/raw` all treat it
+as gone). Files stay on disk until the trash is purged (Empty Trash in the app).
+Returns `204` with no body.
 
-You can only delete artifacts your own token owns; others return `404`, as
-does a second delete of the same id.
+**Idempotent:** deleting an already-trashed id returns `204` again (not `404`).
+You can only delete artifacts your own token owns; another user's returns `404`.
+There is no API endpoint to undelete or purge yet — that's app-UI-only.
 
 ```bash
 curl -X DELETE "http://127.0.0.1:8001/api/artifacts/a1b2c3d4" \