feat(coach): facts management routes (list + forget)

Add the GDPR/trust surface for the durable Coach facts: GET lists the
caller's active facts decrypted, DELETE /[id] soft-deletes one, and a
bulk DELETE clears all — every verb apiHandler + requireAuth +
requireAssistantSurface("coach") + ownership-scoped, with an unknown or
cross-user id collapsing to an idempotent no-op that never leaks
existence. Registered in the OpenAPI contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/analytics/__tests__/route.test.ts

@@ -267,6 +267,7 @@ describe("GET /api/analytics", () => {
     vi.mocked(prisma.$queryRaw).mockResolvedValueOnce([
       { n: BigInt(0) },
     ] as never);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     vi.mocked(prisma.$queryRawUnsafe as any)
       .mockResolvedValueOnce([
         {