feat(recycle-bin): soft delete + restore for master data

Accidental admin deletes of users/roles/subscriptions/plans/tariffs were
hard and unrecoverable. Now they soft-delete into a recycle bin.

Schema (migration 0012): nullable deleted_at + deleted_by on users, roles,
subscriptions, subscription_plans, tariffs. Additive ADD COLUMN; verified
against a copy of the live DB.

Backend: each resource's DELETE route STAMPS instead of removing; every
catalog list filters deleted_at IS NULL. New recycle-bin module + routes
(GET /api/recycle-bin, POST .../restore, DELETE .../:id purge) gated on a
new recyclebin:read/update/delete permission. A 6-hourly + startup sweep
auto-purges items older than RECYCLE_BIN_RETENTION_DAYS (default 30; 0 =
forever).

Invariants: soft-deleted users can't log in (login rejects deleted_at;
no-lockout counts live admins only); a soft-deleted subscription doesn't
open the barrier; plans are versioned so a delete stamps all versions of
the plan_id (bin shows one item); username/role-name UNIQUE spans deleted
rows so reuse returns a clear 409 pointing at the bin; restore doesn't
auto-cascade a dangling role (guard resolves missing role to empty perms).
The signed append-only ledger is OUT of scope (no delete path).

Web: a Recycle bin tab under Setup (RecycleBin.tsx) with Restore/Purge +
purge confirm; api client + i18n (sq + en parity).

Tests: recycle-bin.test.ts (9 unit) + recycle-bin-routes.test.ts (4
integration: delete -> can't-login -> restore -> login, purge, gating,
409 reuse). server 103/103; build+lint+test 19/19.

Wiki: new concepts/soft-delete.md; local-jwt-auth + index + log updated.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/shared/src/index.ts

@@ -27,6 +27,7 @@ export const RESOURCES = [
   "event", // the signed ledger feed + void
   "report", // events feed, occupancy, future reports
   "log", // application/diagnostic logs (app_logs) — view + retention
+  "recyclebin", // soft-deleted master data: view / restore / purge
 ] as const;
 export type Resource = (typeof RESOURCES)[number];
 
@@ -56,6 +57,9 @@ export const PERMISSIONS: readonly Permission[] = [
   "event:read", "event:void",
   "report:read",
   "log:read",
+  // Recycle bin: read (list soft-deleted items), update (restore), delete (purge). These
+  // are admin-grade — a restore can revive a privileged user/role, a purge is permanent.
+  "recyclebin:read", "recyclebin:update", "recyclebin:delete",
 ] as const;
 
 /** The protected built-in role: non-deletable, non-editable, always = ALL