Delete a block volume

Deletes the block volume volumeId from the active scope. The UI exposes this from the volume detail header ("Delete"), per-row actions, a bulk action over selected rows, and the "Remove data disk" affordance in the create wizard. Deletion permanently releases the provisioned capacity; snapshots and backup recovery points derived from the volume are NOT removed and continue to follow their own retention. A failed deletion leaves the volume in a recoverable, queryable state. Validation: volumeId must reference an existing, non-deleted volume in the scope (unknown → 404 NOT_FOUND); the volume must not be attached to an instance and must not be blocked by locks, dependants or retention rules — an attached volume must be detached first (blocked → 409 DEPENDENCY_BLOCKED); a governance/management lock on the volume → 409 LOCKED; caller must hold a destructive-action role owner|admin|contributor (→ 403 FORBIDDEN). Async & state: Asynchronous — returns 202 with an Operation. The volume transitions AVAILABLE → deleting → deleted (soft delete; subsequent reads return 404 while activity retains the audit trail). Progress is emitted as resource.updated SSE frames (kind storage.volume, patch {status}) followed by a terminal operation.completed frame. Errors: 401 unauthenticated; 403 caller lacks destructive permission; 404 unknown scopeId/volumeId; 409 DEPENDENCY_BLOCKED volume is attached or has blocking dependants; 409 LOCKED a resource lock forbids deletion; 409 DELETION_PROTECTED the volume's deletionProtection is on (-- refused before any Operation is opened; turn it off with the metadata PATCH, then retry); 412 If-Match ETag does not match the current volume revision; 500 unexpected backend failure. Idempotency/Concurrency: Idempotency-Key is recommended; replaying the same key returns the original 202 Operation without enqueuing a second deletion. If-Match with the ETag from the detail read protects against deleting a concurrently modified volume.