DELETE /artifacts/{digest}: superuser only, 409 while referenced

The keep-set the hourly sweep uses is now referenced_artifacts, shared by
the sweep and the route. The volatile ring is not touched.

frontend/src/client/types.gen.ts

@@ -1620,6 +1620,12 @@ export type ArtifactsGetArtifactData = {
 
 export type ArtifactsGetArtifactResponse = (unknown);
 
+export type ArtifactsDeleteArtifactData = {
+    digest: string;
+};
+
+export type ArtifactsDeleteArtifactResponse = (void);
+
 export type CloudReadStatusResponse = ({
     [key: string]: unknown;
 });