Trash for annotations: soft delete with restore and purge

[saad-mhmd]

Deleting a Graph annotation is permanent the moment it commits. Any logged-in user can delete non-editorial annotations from the viewer, and the nightly whole-DB dump cannot recover one wrongly deleted row without discarding a day of everyone's work.

Add a trash for Graph:

• Viewer/backoffice deletes set deleted_at/deleted_by instead of destroying the row; trashed rows disappear from all public reads, counts, and the next search reindex.
• New backoffice page Admin → Trash: list, restore, and purge (permanent, superuser-only). Nothing is purged automatically.
• Purge is a real delete, so the corresp-strip signal and the deleted audit event fire; a restored TEXT graph gets its text↔image link back intact.

Scope: Graph only (v1). ImageText and the ItemImage/ItemPart/HistoricalItem spine are a follow-up pending review.

[saad-mhmd]

trash v1 is done (annotations only) - PRs #157 (backend) and archetype-pal/frontend#109

for now:

• Deleting an annotation no longer destroys it. It moves to a trash, hidden from the site and search, and an admin can restore it or delete it permanently from a new backoffice 'Trash' page, with filters by type, by who deleted it, and by date.
• Restoring brings the annotation back exactly as it was, including its link to the text.
• Items stay in the trash until a person acts.

What it deliberately does NOT cover yet:

• Only annotations. Deleting an image, item part, or manuscript still permanently deletes everything under it, including annotations that were sitting in the trash. The framework deletes the whole chain in one sweep (CASCADE at the ORM level) and the trash cannot catch it.
• Search results still update only on the next manual reindex.
• Recovery goes through an admin.

Two small related fixes shipped separately: #158 (a permission hole around editorial annotations) and #160 (deletes blocked by existing data now explain themselves - e.g. "Cannot delete: still referenced by 121 graphs", instead of failing with a server error).