Delete a VM snapshot

Soft-deletes the selected VM snapshot, as triggered by the destructive "Delete" action in the Snapshots page row menu and the VM snapshot detail page header. The snapshot is removed from all scoped lists, its billed storage stops accruing, and the freed capacity is reclaimed asynchronously. Failure leaves the snapshot in a recoverable, queryable state. Validation: the snapshot must exist in the scope and not already be soft-deleted (404 NOT_FOUND); deletion must not be blocked by an unresolved dependency — a snapshot that is the source of a machine image, of an in-flight "create instance from snapshot" launch, or that a retention rule pins, maps to 409 DEPENDENCY_BLOCKED with the blocker identified; a snapshot still CREATING must finish or fail before it can be deleted (409 DEPENDENCY_BLOCKED). The caller needs destructive-action rights on the scope (403 FORBIDDEN otherwise). Async & state: Asynchronous (202) returning an Operation handle. The snapshot enters a visible deletion workflow and is then soft-deleted (excluded from reads via deleted_at); a resource.deleted-style resource.updated SSE frame is emitted for the snapshot id when the Operation reaches succeeded; on failed the snapshot remains queryable in its prior state. Errors: 401 unauthenticated; 403 insufficient role for a destructive action; 404 unknown snapshot; 409 DEPENDENCY_BLOCKED when an image, launch or retention rule depends on the snapshot; 412 stale If-Match ETag; 500 internal failure. Idempotency/Concurrency: Idempotency-Key recommended; replaying the same key returns the original Operation instead of enqueueing a second delete. If-Match with the snapshot's current ETag guards against deleting a concurrently modified resource (412 PRECONDITION_FAILED on mismatch).