Close citation/source living-person leak; add on-demand tree purge

Two changes.

1. Privacy fix (NN#2/NN#3) — the citation and source list endpoints gated only
   on can_view_tree, so a non-member on a public/unlisted/site_members tree could
   enumerate citations and sources tied to a redacted living person, leaking that
   the person exists and has sourced facts (and possibly their name via a source
   title). #46 closed this for events/media/names/relationships but not
   citations/sources. Now citation_service.list_citations and
   source_service.{list_sources,get_source} delegate non-member reads to
   public_view_service, mirroring the #46 pattern:
   - citations: shown only when the cited fact resolves to FULL-visibility
     person(s) — covers the person_id, name_id, event_id (person or both-partner),
     and relationship_id (both-partner) target paths.
   - sources: shown only when they back at least one visible citation; a withheld
     source 404s (don't reveal it exists).
   Tests cover all four citation target types + source withholding + member-sees-all.

2. On-demand tree purge — owners can permanently delete a soft-deleted tree now
   instead of waiting out the 30-day auto-purge window. POST /trees/{id}/purge
   (owner-only): the tree must already be in the trash, and the caller retypes its
   name to confirm. Media objects are deleted from storage, then a single
   DELETE on trees cascades all tree-owned rows via the tree_id ON DELETE CASCADE;
   the audit entry survives (tree_id SET NULL). Frontend adds a "Delete forever"
   button to the Recently-deleted list. No migration.

Suite: 102 passing.
Signed-off-by: Justin Paul <justin@jpaul.me>

frontend/app/trees/page.tsx

@@ -53,6 +53,26 @@ export default function TreesPage() {
     await api.POST("/api/v1/trees/{tree_id}/restore", { params: { path: { tree_id: id } } });
     load();
   }
+  async function purge(id: string, treeName: string) {
+    const typed = window.prompt(
+      `Permanently delete "${treeName}" and ALL its data (people, sources, media, …)?\n\n` +
+        "This CANNOT be undone. Type the tree name to confirm:",
+    );
+    if (typed == null) return; // cancelled
+    const { error, response } = await api.POST("/api/v1/trees/{tree_id}/purge", {
+      params: { path: { tree_id: id } },
+      body: { confirm_name: typed },
+    });
+    if (error) {
+      window.alert(
+        response.status === 403
+          ? "The name didn't match — nothing was deleted."
+          : "Couldn't purge that tree.",
+      );
+      return;
+    }
+    load();
+  }
   // Optimistic visibility change so the dropdown reflects the pick immediately.
   async function setVisibility(id: string, visibility: NonNullable<Tree["visibility"]>) {
     setTrees((cur) => cur.map((t) => (t.id === id ? { ...t, visibility } : t)));
@@ -139,15 +159,28 @@ export default function TreesPage() {
           <h2 className="font-serif text-base font-semibold text-[var(--muted)]">
             Recently deleted
           </h2>
+          <p className="text-xs text-[var(--muted)]">
+            Restorable for 30 days, after which they&apos;re purged automatically. Use
+            Delete forever to purge one now.
+          </p>
           <ul className="space-y-2">
             {deleted.map((tree) => (
               <li key={tree.id}>
                 <Card>
-                  <CardContent className="flex items-center justify-between p-4">
-                    <span className="text-[var(--muted)]">{tree.name}</span>
+                  <CardContent className="flex items-center justify-between gap-2 p-4">
+                    <span className="min-w-0 flex-1 truncate text-[var(--muted)]">{tree.name}</span>
                     <Button variant="outline" size="sm" onClick={() => restore(tree.id)}>
                       Restore
                     </Button>
+                    <Button
+                      variant="outline"
+                      size="sm"
+                      onClick={() => purge(tree.id, tree.name)}
+                      className="border-bronze/40 text-bronze hover:bg-bronze/10"
+                      title="Permanently delete this tree and all its data"
+                    >
+                      Delete forever
+                    </Button>
                   </CardContent>
                 </Card>
               </li>