fix: authorize ownership and validate before deleting in DELETE /documents

[nangelovv]

What

Add an ownership check to DELETE /documents and move both the existence and ownership checks before the destructive delete.

Why

Fixes #303.

1. The endpoint had no user_id check, so any authenticated caller could delete another tenant's chunks by file_id.
2. It deleted first and validated existence afterwards, so a request mixing valid and unknown ids destroyed the valid rows and still returned 404.

Change

• Resolve the requester with get_user_id(request, entity_id) (adds an optional entity_id form/query param, consistent with the embed endpoints).
• Fetch the target documents and:
  • 404 if any requested id does not exist — before deleting;
  • 403 if any chunk's user_id is neither None (unowned) nor the requester — before deleting.
• Only then call vector_store.delete(...).

Note — contract change

DELETE /documents now requires the caller to own (or the document to be unowned) every id. Self-deletes via the user's identity are unaffected; public-mode documents (user_id="public") still match. An unauthenticated process deleting arbitrary ids would now be rejected. (Related closed PR: #262.)

Testing

• New tests/test_main.py:
  • test_delete_documents_rejects_other_users — another user's docs → 403 and delete() is never called.
  • test_delete_documents_validates_before_deleting — an unknown id → 404 and delete() is never called.
• Existing test_delete_documents (self-owned/unowned) still passes. tests/test_main.py: 12 passed.