Delete a subnet

Removes a single subnet from the given virtual network (the subnet-row delete affordance in the network detail page), so a mis-CIDR'd subnet can be undone without destroying the whole network. Validation: the subnet must exist under the given network else 404 NOT_FOUND (also 404 when networkId itself is unknown or not visible to the caller). A subnet still in use — any non-DHCP port holds a fixed IP on it (a customer NIC) or a router interface attaches it — is refused 409 DEPENDENCY_BLOCKED, with the blocking ports listed in ApiError.details.ports; the caller detaches those first. The subnet's own DHCP port is auto-removed and never blocks. Async & state: Synchronous (204): subnet teardown is a fast control-plane write and no transitional state exists. A resource.updated SSE frame for the parent network (kind: network, patch: {subnets}) is emitted so other sessions converge. Errors: 401 unauthenticated; 403 caller lacks contributor rights; 404 unknown networkId/subnetId; 409 DEPENDENCY_BLOCKED when the subnet still has attached ports/interfaces; 412 PRECONDITION_FAILED on a stale If-Match; 500 on delete failure. Idempotency/Concurrency: an optional If-Match against the detail-read ETag is honored — a mismatch returns 412 and leaves the subnet in place; a missing header is last-write-wins. Delete is not freeze-gated. RBAC owner|admin|contributor.