feat(fc-cleanup): api/cleanup.py blueprint (9 endpoints) + register + delete-audit-<id> token (matches modal convention) — Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/services/cleanup_service.py

@@ -481,7 +481,11 @@ def apply_audit_run(
         raise ValueError(f"audit_run {audit_id} not found")
     if audit.status != "ready":
         raise AuditNotReady(audit.status)
-    expected = f"apply-audit-{audit_id}"
+    # Token format matches modal/DestructiveConfirmModal.vue convention:
+    # ${action}-${kind}-${runId}. The modal hardcodes action ∈ {'restore',
+    # 'delete'}; "apply audit" is semantically a delete of the matched
+    # images, so we use 'delete-audit-<id>' (not 'apply-audit-<id>').
+    expected = f"delete-audit-{audit_id}"
     if confirm_token != expected:
         raise ConfirmTokenMismatch(expected)
     ids = list(audit.matched_ids or [])