Permanently erase a session with a new flag on /session/delete

/session/delete can now permanently erase a session instead of only revoking it.

What's new

• confirmIrreversible on POST /session/delete. Set to true to permanently delete a player session and its embedded consent, scoped to the calling product. Unlike the default revoke (which is internally retained), this physically removes the record and can't be undone.
• Opt-in per developer. Available only to developers explicitly enabled for hard delete. Setting confirmIrreversible: true without enablement returns FEATURE_DISABLED.
• Every existing call is unaffected. Omitting confirmIrreversible, or setting it to false, behaves exactly as /session/delete always has: a reversible revoke.
• In-flight challenges are failed too. Any pending challenge tied to that exact session is set to FAIL, scoped to that session only (other sessions for the same player are untouched).

Documentation

• /session/delete API reference