fix(folders): clean up blobs on recursive delete without destroying live citations (#177)

[waterbro-8]

Refs #177

Requirement and scope

Successor to #210 for #177. Keeps the original blob-cleanup implementation and answers the remaining review request: recursive delete must not physically destroy an object still cited by an active/archived memory whose path is outside the folder.

files.storage_key remains per-row (users/<user_id>/<file_id>/<basename>), so unconditional key delete is still safe across file rows. The new hole was memories.source_file_id … ON DELETE SET NULL: a memory at /Work/task citing a file under /Photos would previously pass the path-only guard, the file row would vanish, the FK would null out, and this PR's blob cleanup would then make the cited bytes unrecoverable.

Changes

• Recursive containsMemoriesTx also matches source_file_id against files in the deleted tree (folder_id or literal path prefix). Hit → existing ErrContainsMemories (forget first).
• Integration regression TestRecursiveDeleteBlocksWhenMemoryCitesFileElsewhere.
• Cleanup WARN distinguishes a per-object store error from the shared 30s budget running out.
• docs/DEPLOYMENT.md and [Unreleased] changelog record the citation guard.

Original blob-cleanup work and contributor credit: @xiaocui-big via #210. This successor does not close #210 or #177 automatically.

Validation ledger

ID	Criterion	Command	Environment	Status
V1	Folder package hermetic tests	gofmt + go test ./internal/folder	This checkout; host Go is 1.22.12, module requires 1.25.0; toolchain download timed out	NOT VERIFIED locally — CI must run
V2	Citation-guard integration	MEM_TEST_DB=…_test go test ./internal/folder -run TestRecursiveDeleteBlocksWhenMemoryCitesFileElsewhere	No disposable _test database in this environment	NOT VERIFIED locally — CI PostgreSQL job
V3	Server regression	make test-server	Same toolchain gap	NOT VERIFIED locally — CI Go job
V4	Patch whitespace	git diff --check	local	PASS
V5	Worker / Web / MCP	unchanged	N/A	N/A — no worker/web/mcp/API contract change beyond folder delete refusal

Risk / rollback

Recursive delete of a folder whose files are still cited by live memories now fails closed instead of deleting the blobs. Revert this branch to restore path-only guarding (and, if #210 is also reverted, orphan blobs on recursive delete).

No merge, release, or issue closure is claimed.

[waterbro-8]

Pushed a test-only follow-up (1db043b) for the CI failures:

• create a resource-owner workspace before folder create (the lock was no rows in result set)
• insert memories with idempotency_key_sha256 (the live column after 0012)
• add source_file_id to the session-local memories shadow table so TestMemoryPathLifecycleIntegration still compiles against the recursive citation guard

PR body now also has Refs #177.

[waterbro-8]

Follow-up e7e5bba: the remaining Go failure was the same class of 42P08 as #218 — $3 was bound to both source_file_sha256 (text) and idempotency_key_sha256 (char(64)). Those are now separate parameters.

I cannot approve this PR: last push is mine. Needs another CODEOWNER after CI is green.

[waterbro-8]

Waiting on CI for e7e5bba (42P08 fixture). I cannot approve: last push is mine. Needs @PeterGuy326 or @Bindy-lbb after green.

[waterbro-8]

请评审合入（作者是我，不能自批）。

• 递归删文件夹会清 blob，并在 source_file_id 仍被活记忆引用时拒绝删除。
• 测试侧 42P08 已拆参数（e7e5bba）。

需要 @PeterGuy326 或 @Bindy-lbb 作为非作者 CODEOWNER 批准后才能进 main。

[PeterGuy326]

Independently reviewed current head e7e5bba against base 1b27aac. The folder regression suite passes on Go 1.25.9/darwin arm64 (go test ./internal/folder -count=1), git diff --check passes, and the required CI checks are green. No blocking finding remains; approving as a non-author CODEOWNER.