Make thread/channel/message deletion complete (hard delete)

Deleting a thread, channel, or message was a no-op/soft-delete: messages
were only dropped from the plugin outbox (still in hermes' session store,
hence searchable/recoverable) and channels/threads were merely archived.

Now deletion is complete and non-recoverable, with no search trace:

- purge.py (new): hard-delete from hermes' session store (state.db).
  delete_lane wipes a channel's/thread's sessions + messages; deleting a
  messages row also drops it from the FTS5 index via the delete triggers.
  delete_message removes one message, matched by (session, role, exact
  content, closest timestamp) since plugin m_<hex> ids aren't persisted.
- channels.py: delete() hard-deletes the row (and a channel's child
  threads) instead of archiving.
- outbox.py: add delete_lane() (wipe all frames for a lane) and
  message_info() (read a message's final role/text/ts for the match).
- adapter.py: on_channel_delete wipes outbox + session store;
  on_message_delete purges the session-store row per message.
- App: delete confirmations no longer claim history stays for search;
  ChannelStore removes a channel's threads on channel delete.
- Docs updated to describe hard deletion.

docs/06-channels-cron-search.md

@@ -8,7 +8,7 @@ The hermes gateway already models conversations as `SessionSource` with
 gateway identity concepts**.
 
 | App concept | hermes primitive | Example |
-|---|---|---|
+| --- | --- | --- |
 | Default chat | home channel `chat_id` | `android:default` |
 | A thread (inside default chat) | `thread_id` under the default `chat_id` | `chat_id=android:default, thread_id=t_12` |
 | A user-created channel | a new `chat_id` | `android:chan_7` |
@@ -85,8 +85,10 @@ lane (nothing to title / session-scoped, not conversation starters).
   `chat_id = android:chan_<n>`, stores in directory, broadcasts
   `channel.created` to all devices. The new channel appears in the channel list.
 - **`channel.rename` / `channel.set_default` / `channel.delete`** manage the
-  directory (rename broadcasts `channel.renamed`; delete is soft — marks
-  archived, keeps history for search).
+  directory (rename broadcasts `channel.renamed`; delete is a **hard delete**
+  -- the channel/thread row is removed and the lane's history is wiped from
+  the outbox and the hermes session store, so nothing is recoverable and no
+  search trace survives).
 - **Automation channels:** a channel can be marked *automation*
   (`channel.set_automation {on}`, long-press / right-click menu; the default
   channel cannot be marked). Automation channels are **read-only for the
@@ -148,4 +150,4 @@ lane (nothing to title / session-scoped, not conversation starters).
 
 `hello.ack` and `channel.*` frames carry the directory. App keeps a local copy
 (Room) and reconciles on `channel.*` events (merge, don't clobber — see
-`10-android-app.md` state rules).
+`10-android-app.md` state rules).