DELETE /artifacts/{digest}: superuser only, 409 while referenced

The keep-set the hourly sweep uses is now referenced_artifacts, shared by
the sweep and the route. The volatile ring is not touched.

docs/code/api.md

@@ -172,6 +172,11 @@ curl "$FLUKSIO/artifacts/<digest>" \
 The upload returns a reference with the content digest. Identical bytes are
 stored once. Node code uses `save_artifact` and `load_artifact` instead.
 
+A superuser can remove stored bytes with `DELETE /artifacts/<digest>`. While
+a run, a current message or a flow input's initial value still references the
+digest, the call returns `409`. The hourly sweep removes unreferenced bytes
+on its own, so this is for reclaiming space sooner.
+
 ## Dashboards and panels
 
 | Method | Path | Action |