fix #63: require deletion token on DELETE /api/pastes/{id}

- DELETE now demands the create-time deletion token (Authorization
  header: Bearer/Token/bare, or ?token= query param), compared with
  the constant-time store.DeletionTokenEqual. 403 otherwise.
- Creator-browser deletes via the /mine button (matching vwr cookie,
  #37) remain allowed; other browsers and plain API clients get 403.
- Regression tests: no token, wrong token (header+query), correct
  token (header+query), creator-cookie path, token extraction.
- Adapted TestSoftDelete to pass the deletion token.
- docs/API.md delete section updated.
- Based on #58's SoftDelete (bool, error) signature.

docs/API.md

@@ -54,8 +54,10 @@ Raw reads count against a burn-after-read budget, same as page views.
 ## Delete
 
 ```bash
-# soft delete (creator browser only; plain API clients unaffected)
-curl -X DELETE http://localhost:8080/api/pastes/{id}
+# soft delete (requires the deletion token from the create response)
+curl -X DELETE -H "Authorization: Bearer TOKEN" http://localhost:8080/api/pastes/{id}
+# ...or via query param; the creator browser (viewer cookie) may also delete without a token
+curl -X DELETE "http://localhost:8080/api/pastes/{id}?token=TOKEN"
 
 # hard delete immediately (requires the one-time deletion token)
 curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"