fix(evidence): enforce active vector generations

harness/scripts/create_vector_writer_rpc.sql

@@ -101,9 +101,30 @@ begin
 end;
 $$;
 
+create or replace function public.delete_vector_generation(
+  table_name text, kind text, generation text
+)
+returns jsonb
+language plpgsql
+security definer
+set search_path = public, vectors, extensions
+as $$
+declare affected integer;
+begin
+  if table_name <> 'evidence' or kind <> 'evidence' or generation !~ '^gen:[0-9a-f]{32}$' then
+    raise exception 'only an exact Evidence generation may be deleted';
+  end if;
+  delete from vectors.evidence e
+   where e.kind = 'evidence' and e.metadata->>'vector_generation' = generation;
+  get diagnostics affected = row_count;
+  return jsonb_build_object('deleted', affected);
+end;
+$$;
+
 revoke all on function public._assert_vector_write_table(text, text[]) from public;
 revoke all on function public.existing_vector_hashes(text, text[]) from public;
 revoke all on function public.upsert_vector_records(text, jsonb) from public;
+revoke all on function public.delete_vector_generation(text, text, text) from public;
 
 -- Su alcuni progetti Supabase le funzioni in `public` ricevono grant automatici: revoca
 -- esplicitamente dai ruoli client generici, poi abilita solo il writer dedicato.
@@ -112,14 +133,17 @@ begin
   if exists (select 1 from pg_roles where rolname = 'anon') then
     revoke all on function public.existing_vector_hashes(text, text[]) from anon;
     revoke all on function public.upsert_vector_records(text, jsonb) from anon;
+    revoke all on function public.delete_vector_generation(text, text, text) from anon;
   end if;
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
     revoke all on function public.existing_vector_hashes(text, text[]) from authenticated;
     revoke all on function public.upsert_vector_records(text, jsonb) from authenticated;
+    revoke all on function public.delete_vector_generation(text, text, text) from authenticated;
   end if;
   if exists (select 1 from pg_roles where rolname = 'vector_writer') then
     grant execute on function public.existing_vector_hashes(text, text[]) to vector_writer;
     grant execute on function public.upsert_vector_records(text, jsonb) to vector_writer;
+    grant execute on function public.delete_vector_generation(text, text, text) to vector_writer;
   end if;
 end $$;