JAMES-4201 Remove the password.nodelete webadmin access level

[chibenwa]

password.nodelete was introduced alongside password.readonly and never released. It promised that such a credential "can read and create/modify data but cannot delete", but the filter only compares the literal HTTP method, while WebAdmin models plenty of destructive operations as POST or PUT:

• POST /users/{username}?action=deleteData and POST /domains/{domainName}?action=deleteData erase user data through a task,
• PUT /users/{username} resets the password of an existing account, which is a full account takeover,
• PUT /domains/{domain}/aliases/{alias} and the forward routes reroute mail.

Making the filter action-aware would only paper over this: on an administration API where creating and updating is as destructive as deleting, "everything but the DELETE verb" cannot be a privilege separation, merely a guard-rail against mistyped curl commands - one that reads as a security boundary and is documented as one.

So drop the level rather than keep a boundary we cannot honour. password (full access) and password.readonly (GET/HEAD only) remain, the latter being sound since no WebAdmin GET route mutates state.

Genuine partial privileges need an authenticated administrator identity and a per-route, per-parameter authorization model - neither of which WebAdmin has, and both of which belong in a reverse proxy in front of it rather than in a verb filter inside James. The documentation now says so instead of advertising a delete/no-delete separation.