docs(m3): close create contract gaps (soft delete, publish poll, prompts, image volume)

- R1 soft delete: add deleted_at to slabs; exclude deleted rows from GETs
- R2 publish: terminal poll returns woo_product_id then the working row is
  discarded; the app never deletes from WooCommerce (reworks PUBLISH-25)
- R3 prompts: SQLite is the point of record; file-based prompts superseded,
  compose prompt mount removed
- R4 images: photo bytes are SQLite BLOBs; /images is a health probe + staging

Details recorded in .audit/m3-build-plan.md.

docs/contracts/DATA-MODEL.md

@@ -27,8 +27,14 @@ Status: SPEC · 2026-09-18. Store: SQLite.
 - Multi-select taxonomy values are JSON arrays of Woo ids.
 - Secrets are stored as `value_enc = nonce(12) || ciphertext`, AES-GCM; the master key is the env
   `SLAB_AES_KEY` and is never in the DB.
-- The local slab row is deleted on successful publish; `sync_log` and `inference_log` are
-  append-only and retained.
+- On successful publish the local working slab row is discarded (photos purged, device draft
+  cleared); `sync_log` and `inference_log` are append-only and retained. Nothing is deleted from
+  WooCommerce.
+- Soft delete sets `deleted_at` (text, null until then) on unpublished drafts; deleted rows are
+  excluded from all GET responses.
+- Photo bytes live in `slab_photos` BLOBs; the `/images` volume is not a second store. It holds a
+  health-probe file and short-lived staging for 1024 px Call-1 JPEGs and Woo media uploads, purged
+  after use.
 
 ## 2. `slabs`
 
@@ -61,6 +67,7 @@ Status: SPEC · 2026-09-18. Store: SQLite.
 | `client_rev`, `server_rev` | int | default 1 |
 | `woo_product_id` | int | null until publish |
 | `published_at` | text | null until publish |
+| `deleted_at` | text | null until soft-deleted; unpublished drafts only |
 | `created_at`, `updated_at` | text | UTC ISO-8601 |
 
 No `inference_thread_id` column exists; provider threads are not used.