feat(clients): hard-delete with email-code confirmation (single + bulk)

Permanent client deletion is now reachable from:
- archived single-client detail page (icon button, gated by new
  admin.permanently_delete_clients perm)
- archived clients list bulk action

Both flows are 2-stage: request a 4-digit code (sent to operator's
account email, 10min Redis TTL), then enter both code AND a typed
confirmation (client name single, "DELETE N CLIENTS" bulk). Cascade
strategy preserves audit trails: signed documents, email threads,
files and reminders are detached but retained; addresses, contacts,
notes, portal user, GDPR records, interests and reservations are
deleted via FK cascade or explicit tx delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/db/schema/users.ts

@@ -124,6 +124,9 @@ export type RolePermissions = {
     manage_forms: boolean;
     manage_tags: boolean;
     system_backup: boolean;
+    // Permanent client deletion is gated separately from admin.manage_users
+    // because it bypasses archive/restore. Requires email-code confirmation.
+    permanently_delete_clients: boolean;
   };
   residential_clients: {
     view: boolean;

src/lib/db/seed.ts

@@ -92,6 +92,7 @@ const ALL_PERMISSIONS: RolePermissions = {
     manage_forms: true,
     manage_tags: true,
     system_backup: true,
+    permanently_delete_clients: true,
   },
   residential_clients: { view: true, create: true, edit: true, delete: true },
   residential_interests: {
@@ -168,6 +169,7 @@ const DIRECTOR_PERMISSIONS: RolePermissions = {
     manage_forms: true,
     manage_tags: true,
     system_backup: false,
+    permanently_delete_clients: false,
   },
   residential_clients: { view: true, create: true, edit: true, delete: true },
   residential_interests: {
@@ -244,6 +246,7 @@ const SALES_MANAGER_PERMISSIONS: RolePermissions = {
     manage_forms: false,
     manage_tags: true,
     system_backup: false,
+    permanently_delete_clients: false,
   },
   residential_clients: { view: false, create: false, edit: false, delete: false },
   residential_interests: {
@@ -320,6 +323,7 @@ const SALES_AGENT_PERMISSIONS: RolePermissions = {
     manage_forms: false,
     manage_tags: true,
     system_backup: false,
+    permanently_delete_clients: false,
   },
   residential_clients: { view: false, create: false, edit: false, delete: false },
   residential_interests: {
@@ -396,6 +400,7 @@ const VIEWER_PERMISSIONS: RolePermissions = {
     manage_forms: false,
     manage_tags: false,
     system_backup: false,
+    permanently_delete_clients: false,
   },
   residential_clients: { view: false, create: false, edit: false, delete: false },
   residential_interests: {
@@ -475,6 +480,7 @@ const RESIDENTIAL_PARTNER_PERMISSIONS: RolePermissions = {
     manage_forms: false,
     manage_tags: false,
     system_backup: false,
+    permanently_delete_clients: false,
   },
   residential_clients: { view: true, create: true, edit: true, delete: false },
   residential_interests: {