feat(core): add undelete API to reverse soft deletes

[cuibonobo]

Summary

Closes #60.

The spec promises soft-delete recovery — it's half the stated purpose of record versioning — but nothing implements it. Stack/ScopedStack expose delete() and nothing else. #59 sharpened this from "missing polish" to a prerequisite: its trust model for the coarse write bit ("anything a write-holder does, the owner can undo") is false for every deletion until this exists.

What's added

• StackRecordAdapter.undeleteRecord(id): Promise<StackRecord> — a dedicated adapter method, not routed through the generic updateRecord(id, changes: Partial<StackRecord>) grab-bag. That contract can't express "clear deletedAt": every adapter treats an undefined field in the patch as "leave untouched" (confirmed in record-adapter-sqljs, which checks changes.deletedAt !== undefined before including it in the UPDATE), so there's no way to signal removal through it. Implemented in MemoryAdapter, record-adapter-sqljs, and adapter-api (POST /records/:id/undelete), and wired through combineAdapters() and adapter-local's LocalAdapter.
• Stack.undelete(id) — idempotent: undeleting a record that isn't deleted returns it unchanged, so a retried call after a network blip never fails. Missing record throws StackNotFoundError; a hard-deleted record is simply missing, so it throws the same way.
• ScopedStack.undelete(id) — gated by requireDeletable, the same write-bit-or-delete-grant check as delete(). Undelete is the inverse of soft delete, so the same capability governs both directions — granting one without the other would be backwards. Hard delete's owner-only carve-out (Record-level write stays one bit — but everything it permits must be recoverable, and irreversible verbs get carved out #59, already merged) is untouched; it has no inverse.
• migrateAll() now sweeps soft-deleted records too (includeDeleted: true, unconditionally), so a record migrated while deleted comes back current on undelete instead of stranded on a stale schema.
• Spec: docs/spec.md §Deletion documents the API and idempotency contract; the wire endpoint table gains POST /records/:id/undelete; StackClient's method list gains undelete.

Out of scope (tracked separately, per #60's own framing)

• Version-bump-on-delete/undelete — that's One versioning rule: every record mutation bumps version and snapshots full prior state (associations and permissions included) #61 (still open). delete() doesn't bump version today either, so undelete() stays symmetric with it until One versioning rule: every record mutation bumps version and snapshots full prior state (associations and permissions included) #61 lands both together.
• The shared conformance-fixture framework — that's PATCH contract mismatch: spec defines content-only merge patch, APIAdapter sends record-field envelopes #52's cross-repo deliverable and doesn't exist in this repo yet. Covered here with regular adapter-level tests instead.

Test plan

• Added tests across packages/core (Stack.undelete, ScopedStack.undelete, migrateAll sweep), record-adapter-sqljs, and adapter-api
• pnpm -r build — clean
• pnpm -r typecheck — clean across all 6 packages
• pnpm -r lint — clean
• pnpm -r test — 348 tests passing workspace-wide
• prettier --check on changed files — clean

Refs #60, #59, #61, #52, #47

---

Generated by Claude Code