feat: make hard deletion of disliked tracks real

The dislike lifecycle promised WARNED -> HIDDEN -> deleted, but nothing ever
removed a file: cleanup.service logged its intent behind
MUZICK_ALLOW_HARD_DELETE and returned, and the two backend delete paths
(hardDeleteTrack, permanentlyDeleteTrack) disagreed about what deletion
meant. The review recommended dropping hard deletion and making HIDDEN
terminal; the owner chose to make deletion real instead.

  - cleanup.service performs a true unlink() — no trash directory — for
    tracks that have been HIDDEN for a 7-day grace period, then settles the
    row. This is the single unlink() call site in the system.
  - permanentlyDeleteTrack is the one delete path; hardDeleteTrack is gone.
  - a deleted_permanent audit row records what was removed, and
    migration 20260730_hard_delete_audit_trail backs it.

MUZICK_ALLOW_HARD_DELETE remains OFF: the docker-compose entry is commented
out, there is no enabling default in code, and the worker's /music bind is
the only writable one. Deletion stays dry-run until the owner opts in
deliberately.

REVIEW-2026-07-30.md open decision: dislike lifecycle.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -69,8 +69,23 @@ services:
       DISCOGS_TOKEN: ${DISCOGS_TOKEN}
       SOCKS_PROXY_URL: ${SOCKS_PROXY_URL}
       MUSIC_DIR: /music
+      # Hard-deletion gates for the dislike lifecycle (invariant §C). All three
+      # default to the safe value inside cleanup.service.ts; they are listed here
+      # as documentation and are intentionally left unset.
+      #
+      # MASTER SWITCH — leave unset/false. While off, the cleanup sweep logs
+      # exactly which files it WOULD delete and changes nothing at all. Set to
+      # true by hand, only after reviewing a dry-run log:
+      #   MUZICK_ALLOW_HARD_DELETE: "false"
+      # Blast-radius cap per sweep (default 5):
+      #   MUZICK_HARD_DELETE_MAX_PER_SWEEP: "5"
+      # Days a track must sit in HIDDEN before its file is eligible (default 7):
+      #   MUZICK_HARD_DELETE_GRACE_DAYS: "7"
     volumes:
-      - /mnt/hdd1/media/Music:/music:ro
+      # READ-WRITE, and the only rw mount of the library in the stack. The worker
+      # is the sole process permitted to unlink a music file, and only via the
+      # gated cleanup sweep. The backend keeps `:ro`.
+      - /mnt/hdd1/media/Music:/music:rw
 
 networks:
   infra-net: