fix(intake): tombstone cancelled submissions

[veryCrunchy]

Summary

• add an idempotent DELETE /api/v1/receipts operation that terminally cancels a submission by its hashed idempotency key
• serialize report creation and cancellation through a durable submission-state row so a delayed upload cannot recreate a cancelled report
• delete any already-created private report and diagnostic object, return 410 Gone to late or reconciled cancelled submissions, and document the API contract

Root cause and impact

The existing API could delete only after the client had received the server-generated capability. If an upload result was ambiguous and no receipt existed yet, the client had no authoritative way to cancel a request still buffered in transport. A local timeout could therefore either trap the user in recovery or discard the only deletion capability before a delayed private report was committed.

This tombstone is the server-side terminal result consumed by Obiente/nc-native#386. It stores only the one-way idempotency hash and prevents private report creation after cancellation wins the race.

Advances #1.

Validation

• gofmt -l internal cmd returned no files
• go test ./...
• go vet ./...

Validated with Go 1.24 on the dedicated build host.