Delete a key pair from the active scope

Deletes the selected key pair, as triggered by the "Delete" action on the key pair detail page and the row action on the Key pairs page. Deleting a key pair removes it from the scoped registry so it can no longer be attached to new instances; instances already configured with the key keep their injected authorized_keys entry (guest state is untouched). The detail UI blocks deletion while the key is still configured on instances ("Detach … from N instance(s) first") — the backend enforces the same dependency rule. Validation: scopeId must be accessible to the caller (404 when unknown); keyPairId must identify a key pair within that scope (404 NOT_FOUND); the key pair's usedBy set must be empty — when one or more instances still reference the key the request maps to 409 DEPENDENCY_BLOCKED with the blocking instance references; the resource must not be locked (409 LOCKED is reserved for scope locks). Async & state: Asynchronous soft delete; returns 202 with an Operation. The key pair transitions active → deleting → deleted; on completion it disappears from list reads (soft delete: rows are retained with deleted_at set and excluded from every query) and a resource.updated SSE frame of kind compute.keyPair announces the removal. Terminal states: succeeded (deleted) or failed (key pair remains queryable and recoverable). Errors: 401 unauthenticated; 403 caller lacks destructive-action permission (owner|admin|contributor); 404 unknown scopeId/keyPairId; 409 dependency blocked while instances still use the key; 500 delete workflow failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key returns the same 202 Operation. This operation does not check If-Match; a sent one is ignored (an instance still using the key is the 409 above, evaluated at the time of the delete).