feat: add delete chat turn functionality with attachment cleanup

[wedone]

Description

This PR adds the ability to delete a specific Q&A turn (user + assistant message pair) from a WebUI Chat session, along with proper cleanup of associated attachment files.

Key changes:

Backend:

• Added AttachmentStore.delete_attachment(session_id, attachment_id) method to delete individual attachment files from disk
• Added SQLiteSessionStore.delete_turn_by_message(session_id, message_id) method that:
  • Finds the paired user/assistant message and associated turn
  • Checks if the turn is currently running (returns early with was_running=True to prevent data loss)
  • Extracts attachment IDs from attachments_json for cleanup
  • Cascades deletion to turn_events, turns, and messages
  • Resets summary_up_to_msg_id when deleted messages fall within the summary range
• Added DELETE /api/v1/sessions/{session_id}/messages/{message_id} endpoint with:
  • 409 response for running turns (checked before 404)
  • 404 response for non-existent messages
  • Best-effort attachment file cleanup after DB deletion
• Bug fix: delete_session endpoint now calls AttachmentStore.delete_session() to clean up attachment files (previously implemented but never called)

Frontend:

• Extended MessageItem interface with id?: number field, mapped from backend SessionMessage.id
• Added deleteMessage(sessionId, messageId) API function in session-api.ts
• Added DELETE_TURN reducer action that removes the user+assistant message pair from state
• Added deleteTurn(messageId) context method with temporary ID resolution (reloads session if message has a client-side temporary ID)
• Added delete button on user message bubbles (visible on hover) with inline confirmation dialog
• Wired up onDeleteTurn callback through ChatMessageList → UserMessage → page component

Related Issues

• Fixes attachment file leak when deleting sessions (existing bug)

Module(s) Affected

• api
• services
• web (Frontend)

Checklist

• I have read and followed the contribution guidelines.
• My code follows the project's coding standards.
• I have run pre-commit run --all-files and fixed any issues.
• I have added relevant tests for my changes.
• I have updated the documentation (if necessary).
• My changes do not introduce any new security vulnerabilities.

Additional Notes

Design decisions:

• Turn-level deletion (not single message): Deleting a Q&A pair avoids orphan messages and matches user mental model ("delete this conversation turn")
• Running turn protection: The was_running check happens before any data deletion to prevent data loss. The API returns 409 if the turn is actively streaming
• Attachment cleanup: Attachment file deletion failures are logged but don't block the message deletion (best-effort cleanup)
• Temporary ID handling: If a user tries to delete a message that still has a client-side temporary ID (negative number), the frontend first reloads the session to get the real backend ID before making the API call