Reserve delete fields and surface edge delete failures

[tomsmith8]

G1 from the graph delete-model plan (graph-delete-model/plan-v2.md, §6.3).

Depends on: nothing. Can merge any time (§7).

§5 row consumed:

DELETE /v2/edges/<ref_id> | 200 {status:"Success", status_messages:[]} | 200 {status:"Warning", ...} for missing, other-namespace or not-owned edges; 401 for non-privileged callers. There is no 404.

Changes

• SYSTEM_ATTRIBUTES now includes deleted_at, deleted_at_backfilled and is_deleted (reserved system fields, R7), so node forms never render or submit them.
• Connections panel: handleConfirmDelete used to swallow errors and remove the edge locally anyway. It now removes the edge only when the request succeeds. On failure the row stays and an inline error appears under it, using the same pattern as My Content. The error clears when you retry.
• Copy: no confirm text implies a delete can be undone ("Remove?", "Delete this content?"), so nothing changed.

Tests

• node-remap.test.ts: the new attributes are in SYSTEM_ATTRIBUTES.
• connections-section.test.tsx: a failed edge delete keeps the edge and shows the error; retrying clears it.