v1.46.5: audit of every automatic deletion

Owner's decision after the incident: a detached plan is never deleted, at any
age. v1.46.4 gave it a month; this makes it permanent and, more importantly,
writes the reasoning where the next change will trip over it — docs/SCOPE.md now
carries the standing rule. The component may delete a file only when a user
action says so. 'Nothing points at this any more' is not such an action, because
the two errors are not symmetrical: wasted disk is visible, cheap and
reversible; a deleted file is none of those.

Went through every other automatic deletion with the same question. One more
was wrong: houseplan/files/cleanup rmtree'd whatever folder the card named. A
partial migration leaves urls pointing into it — files/migrate deliberately does
not rewrite the ones it could not confirm — so those were live links to files
being deleted; and a wrong or stale id from any client destroyed a live device's
manuals. The server now reads the stored config under its lock and removes only
what nothing references, keeping the rest and saying so.

Also: a plan of a DELETED space now waits thirty days rather than an hour.
Deleting a space is deliberate; an hour is a short window to notice a misclick.

The rest came out clean: layout/delete and marker/room/space removal are all
confirm-guarded user actions, upload temporaries are never user-visible, and
dropping legacy 'segments' is a documented migration.

docs/TESTING.md

@@ -239,10 +239,15 @@ Run the *core flows* (marked ★ below) in each environment at least once per mi
       on the plan after a reload. Same for each tap action and each fill mode
       [auto: backend test_every_display_mode_the_editor_offers_is_accepted and
       neighbours, test_a_marker_showing_its_value_can_be_saved]
-- [ ] Detaching a plan keeps the file (v1.46.4): switch a space to "draw",
-      restart, wait a day — the image is still in `config/houseplan/plans/` and
-      can be re-attached. Replacing a plan still removes the one it replaced,
-      immediately [auto: unit: test_scheduled_collection_never_takes_a_detached_plan]
+- [ ] Detaching a plan keeps the file (v1.46.4/v1.46.5): switch a space to
+      "draw", restart, wait — the image stays in `config/houseplan/plans/`
+      indefinitely and can be re-attached. Replacing a plan still removes the one
+      it replaced, immediately
+      [auto: unit: test_scheduled_collection_never_takes_a_detached_plan]
+- [ ] Rebinding a device does not eat its manuals (v1.46.5): attach two files to
+      a device, rebind it to another HA device — both are readable afterwards.
+      If a copy failed, the file it failed on is still there rather than deleted
+      with the folder [auto: backend test_files_cleanup_keeps_referenced_files]
 - [ ] Nothing accumulates on an idle instance (v1.46.2/v1.46.3, HP-1461-01,
       HP-1462-01): attach a file, cancel the dialog, and do not save anything
       else — the file is gone after a restart AND after the daily pass, while