fix(api): /auth/email/confirm-deletion JSON envelope (BUG-API-047/204/273)

[mastermanas805]

Summary

• /auth/email/confirm-deletion missing-token branch used to `SendString("Missing token")` — `Content-Type: text/plain`, no envelope, no request_id, no agent_action. Envelope-bypass that broke the universal {ok,error,message,request_id,agent_action} contract.
• Agents grepping on `error: missing_token` (the canonical code already used across onboarding.go, deletion_confirm.go:275, magic_link.go) silently failed because this surface returned a plain string.
• Route through `respondError` so the envelope shape + the existing codeToAgentAction[missing_token] entry land here too.

Coverage block

```
Symptom: /auth/email/confirm-deletion text/plain 400 (BUG-API-047/204/273)
Enumeration: rg -F 'SendString' internal/handlers/deletion_confirm.go (1 site)
rg -F 'confirm-deletion' internal/router/router.go (route bind)
Sites found: 1 (deletion_confirm.go:510)
Sites touched: 1
Coverage test: TestEmailConfirmDeletionRedirectHandler asserts status 400,
Content-Type application/json, envelope.ok=false,
envelope.error == 'missing_token', message + agent_action
non-empty.
Live verified: pending auto-deploy + curl -sI 'https://api.instanode.dev/auth/email/confirm-deletion' | grep -i content-type
```

Inbox reference

• BUG-API-047 (P2 — /auth/email/confirm-deletion text/plain 400 envelope bypass)
• BUG-API-204 (P3 — confirm_del with_token 400 text/plain envelope bypass)
• BUG-API-273 (P2 — confirm_del get text/plain 400 envelope bypass duplicate)

Test plan

• `go test ./internal/handlers/ -run TestEmailConfirmDeletionRedirectHandler` green
• `go vet ./...` clean
• Live verify: `curl -sI 'https://api.instanode.dev/auth/email/confirm-deletion' | grep -i content-type` returns `application/json` after auto-deploy
• Live verify rule 14: `curl https://api.instanode.dev/healthz | jq -r .commit_id` matches merge SHA

🤖 Generated with Claude Code