Delete Upload
Delete an upload and its S3 object.
DB record is deleted first (committed on response). S3 cleanup runs
after the response via a background task so the file is only removed
once the DB commit succeeds.
POD-301: if the upload was confirmed against a workspace-scoped resource,
release the bytes back to that workspace's storage counter. Without this,
storage_bytes_used drifts upward forever and customers stay capped after
deleting files. Read upload state BEFORE delete_for_user — the row is gone
after that call.