feat(clients): hard-delete with email-code confirmation (single + bulk)

Permanent client deletion is now reachable from:
- archived single-client detail page (icon button, gated by new
  admin.permanently_delete_clients perm)
- archived clients list bulk action

Both flows are 2-stage: request a 4-digit code (sent to operator's
account email, 10min Redis TTL), then enter both code AND a typed
confirmation (client name single, "DELETE N CLIENTS" bulk). Cascade
strategy preserves audit trails: signed documents, email threads,
files and reminders are detached but retained; addresses, contacts,
notes, portal user, GDPR records, interests and reservations are
deleted via FK cascade or explicit tx delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/helpers/factories.ts

@@ -366,6 +366,7 @@ export function makeFullPermissions(): RolePermissions {
       manage_forms: true,
       manage_tags: true,
       system_backup: true,
+      permanently_delete_clients: true,
     },
     residential_clients: { view: true, create: true, edit: true, delete: true },
     residential_interests: {
@@ -445,6 +446,7 @@ export function makeViewerPermissions(): RolePermissions {
       manage_forms: false,
       manage_tags: false,
       system_backup: false,
+      permanently_delete_clients: false,
     },
     residential_clients: { view: false, create: false, edit: false, delete: false },
     residential_interests: {
@@ -524,6 +526,7 @@ export function makeSalesAgentPermissions(): RolePermissions {
       manage_forms: false,
       manage_tags: false,
       system_backup: false,
+      permanently_delete_clients: false,
     },
     residential_clients: { view: false, create: false, edit: false, delete: false },
     residential_interests: {
@@ -603,6 +606,7 @@ export function makeSalesManagerPermissions(): RolePermissions {
       manage_forms: false,
       manage_tags: true,
       system_backup: false,
+      permanently_delete_clients: false,
     },
     residential_clients: { view: true, create: true, edit: true, delete: true },
     residential_interests: {
@@ -622,6 +626,7 @@ export function makeDirectorPermissions(): RolePermissions {
     admin: {
       ...makeFullPermissions().admin,
       system_backup: false,
+      permanently_delete_clients: false,
     },
   };
 }