Soft-delete an entry (frees its slug and its one-per-registry owner slot)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.