GO-7167 Soft-delete discussion comments

[requilence]

Problem

Deleting a discussion comment removes it from the store and clients get Event.Chat.Delete with only the id. There is nothing left to render the designed "Comment deleted" placeholder from, and every reply under the comment disappears: clients drop a reply whose replyToMessageId chain hits a missing message. Android replies to the tapped message and API agents reply to the message they answer, so this applies to any comment in a thread, not just a post. The replies stay in storage and keep syncing.

Design: docs/superpowers/specs/2026-10-12-discussion-soft-delete-design.md.

Change

Storage (discussions only). The store Delete op is unchanged on the wire. In a discussion, ChatHandler.BeforeDelete turns the message into a tombstone and keeps it (new storestate.DeleteModeKeep).

• The tombstone keeps id, author, createdAt, replyToMessageId and its place (_o).
• It sets deleted: true (new ChatMessage.deleted = 18, sparse index) and is always read and never a mention.
• Content, attachments, blocks, reactions and the pin are cleared, and modifiedAt is reset (all clients show "(edited)" otherwise).
• Space chats still hard-delete.

Apply rules.

• An edit, reaction or pin of a tombstone is dropped at apply time, so delete wins whatever the order changes arrive in.
• A second delete is a no-op.
• A tombstone write failure aborts the apply (ErrCritical).
• A full replay builds the same tombstones, including for deletes made before this change.
• Chat modifies are now update-only. Before, a reaction or pin that arrived after a hard delete re-created a stub message with no author, counted as unread.

Counters and events.

• SoftDelete sends Event.Chat.Update carrying the tombstone and drops the message from the unread, mention and message counters at once, plus the post-commit reload.
• messageCount and GetLastMessage (lastMessageDate) skip tombstones.
• Subscription windows and stream backfill keep them, so replies keep their thread.
• When a full window evicts a message, its pending update is kept, and a later status change in the batch reaches it.

Local guards.

• Edit, reaction and pin need a live, locally stored target (ErrMessageDeleted / ErrMessageNotFound, BAD_INPUT).
• A new reply to a tombstone is refused (ErrReplyToDeletedMessage).
• Deleting a missing or deleted message succeeds without pushing a change.
• SetMessagesPinned checks every target before pinning any.

Search. Full-text hits on tombstones are dropped, and browse reads live messages only. The full-text index removes the comment and never re-adds it.

API v2.

• Messages serve deleted: true with empty text.
• Edit, reaction and delete of a tombstone return 404, and a reply to one returns 400 on /reply_to, dry runs included.
• The middleware refusals map to the same statuses when a delete races the check.
• No new response codes. message_count descriptions updated; OpenAPI and the wrapper golden regenerated.

API v1. deleted field; a reaction to a tombstone returns 400 instead of 500.

Compatibility

• Old apps see no difference. Their heart applies the same Delete op as a hard delete, exactly as today.
• A new heart with a UI that doesn't know deleted. It renders a tombstone as a comment with author and date and no body (checked on desktop, iOS and Android; none crash), and the replies stay attached. Client work:
  • render the placeholder;
  • hide react, reply and edit on a tombstone;
  • desktop: stop removing your own deleted comment locally (post.tsx:439), otherwise the deleter sees the comment and its replies vanish until reload; follow the reply chain to the root;
  • iOS: IOS-5944.
• Same-profile downgrade. A profile a new heart already wrote tombstones into shows them as empty comments on an older heart (documented, no reindex bump).

Not in this PR

• No migration. Comments hard-deleted before this change stay gone on existing stores.
• Two pre-existing bugs, to file separately:
  • a reply applied in the same transaction as its parent loses its mention (the parent lookup reads outside the apply transaction);
  • BeforeCreate skips a message when its full-text enqueue fails.

Tests

• New softdelete_test.go files in chatobject, chatrepository, chatsubscription and chats, and chat_softdelete_test.go in api/v2/service, plus storestate, chatmodel, indexer, v1 handler and service tests.
• They cover the tombstone shape against the pre-delete message, delete-wins in both orders, replay, moderator deletes, counters (including a flush before the reload), events, window eviction, guards, search, the index used by each query, and the exact served JSON.
• go test ./core/... ./pkg/... ./space/... ./util/... passes.