2 HIGH security/correctness fixes from post-v0.28 audit:
- delete.rs: hard-delete now wraps FTS DELETE + table DELETE in
unchecked_transaction. Prior: two separate execute calls could
leave FTS orphan on second-stmt failure. Same pattern as C2 fix.
- archive.rs: archive-UPDATE + FTS DELETE now atomic in one tx.
Prior: archived rows remained searchable (UX/privacy leak).
Semantics documented: archive = hidden from FTS; unarchive must
re-insert (caller responsibility).
+4 regression tests: delete_rollback_on_fts_sabotage,
archive_removes_from_fts, archive_rollback_on_sabotage,
delete_succeeds_when_no_fts_configured. All green (49/49 kes tests).
Constructor Pattern: all files <200 LOC, all functions <30 LOC.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
0706733abf