Add a 5-minute Undo window for deleted clips

[alvst]

Deleting a clip is currently final and one keystroke away. This gives a deleted clip five minutes in which ⌘Z puts it back exactly where it was, with an opt-out for users who don't want deleted content recoverable at all.

What changed

• ClipDeletionLedger records each deleted clip's exact placement (index, predecessor, successor) in whichever container it came from. The payload is kept separate from a small durable tombstone, so a stale synced snapshot can't resurrect an intentional deletion. Payloads are dropped after five minutes; tombstones stay.
• ⌘Z restores the most recent still-undoable deletion at its original position; repeated presses walk back through independent deletions in order.
• An Undo button appears in the bar's top-right while anything is still recoverable, and the bulk-delete confirmation now says so instead of "There is no undo."
• A "Delete permanently" setting (off by default) skips the ledger entirely, plus a per-deletion Option-key override that bypasses Undo for that one deletion regardless of the setting.
• Ledgered clips' image files are protected from cleanup while they're still restorable.

Screenshots

Before:

After:

Notes for review

• Clear History and deleting a whole Pinboard are deliberately outside the ledger. Both are bulk operations: ledgering them means holding the entire history — every image file included — recoverable in store.json for five minutes, which is exactly the retention users who reach for "Clear History" are trying to avoid, and a payload the ledger's per-deletion design isn't shaped for. Single-clip deletion is the frequent accidental one and is what this covers. Clear History keeps its existing confirmation; deleting a Pinboard keeps its existing behavior. Both are unchanged by this PR, not newly excepted by it — happy to add a confirm to Clear History in a follow-up if you'd rather.
• The Option-key bypass and the Settings override both apply per deletion; neither retroactively purges an existing ledger entry beyond the normal five-minute expiry.
• No dependencies; merges in any order.

---

This feature should be bundled into v2.

Part of #80.