feat: propagate child-record deletions via tombstones

[franzer]

Makes deletions of child records (links, tags, annotations, summaries) propagate across machines via tombstones, closing the additive-merge gap flagged during the per-repo sync review.

• New tombstones table. User-facing child deletes (unlink, tag/annotation/summary removal) record a tombstone. Session-cascade deletes (lore delete, prune) do NOT tombstone; they use inline SQL, so deleting your local copy of a session never removes it from the shared store.
• Tombstones sync as an encrypted meta/tombstones blob, union-merged across machines. The blob is rewritten only when the set changes, preserving content-addressed dedup.
• On merge, tombstoned child ids are suppressed on import and removed locally. Suppression matches the exact deleted id, so concurrent adds with different ids are unaffected.
• Applies to both the per-repo and global stores. Age-based GC prunes tombstones after 90 days.

Tests: deletion propagates and is not resurrected; a concurrent add survives a remote deletion; a stale remote blob containing a tombstoned child is suppressed; session-cascade delete records no tombstones; GC; both stores. Full suite green, clippy -D warnings clean.