Deleting products: by their creators, and removal by moderation

A creator deletes a product: it's no longer listed and nobody new can get it, while people who have it
keep it (its page, files and library entries stay, and rooms keep showing it), as old revisions stay
available. Moderation removes one everywhere, with a reason: its page and files answer 410, and it
leaves libraries and rooms. Both are on the product's page and in the audit log.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/src/app.ts

@@ -268,6 +268,7 @@ export function createApp({ db, auth, imvu, realtime: rt, age: ageService, rooms
     parent: latest?.parent ?? 0,
     image: latest?.parentInfo?.image ?? null,
     categories: latest?.parentInfo?.categories ?? [],
+    deleted: p.deletedAt !== null,
     createdAt: p.createdAt.toISOString(),
     updatedAt: p.updatedAt.toISOString(),
   });
@@ -1155,6 +1156,26 @@ export function createApp({ db, auth, imvu, realtime: rt, age: ageService, rooms
         }),
       },
     )
+    // Its creator deletes a product (no longer listed or added; those who have it keep it).
+    .delete(
+      "/products/:id",
+      async ({ me, params, set }) => {
+        await productCall(() => products.delete(me.id, params.id));
+        await audited(me.id, "product.delete", params.id);
+        set.status = 204;
+      },
+      { signedIn: true, params: productParam },
+    )
+    // Moderation removes a product: gone everywhere.
+    .post(
+      "/products/:id/remove",
+      async ({ me, params, body }) => {
+        await productCall(() => products.removeByModeration(params.id, body.reason.trim()));
+        await audited(me.id, "product.remove", params.id, { reason: body.reason.trim() });
+        return { ok: true };
+      },
+      { moderator: true, params: productParam, body: t.Object({ reason: t.String({ minLength: 1, maxLength: 500 }) }) },
+    )
     .post(
       "/products/:id/revisions/:n/retract",
       async ({ me, params }) => {