Hygiene session 0: DELETE returns 204 (breaking) + origin-strategy Hydra cleanups

[tomcrane]

What does this change?

Applies the API-convention rulings made in the DLCS docs/API hygiene sprint's cross-cutting session (session 0, 2026-08-06, ruled in-room by the PO + engineering). One commit per ruling; commits accumulate as the session proceeds. Draft until the session closes. Companion docs PR: dlcs/public-docs#9.

Warning

Breaking changes — please carry these into the release notes:

1. POST /customers/{id}/deleteImages — was 200 OK + { "message": "images deleted" }, now 204 No Content with empty body.
2. DELETE /customers/{id}/resources/pdf/{queryName}?args=... — was 200 OK + { "success": true|false } (including failures reported as success: false inside a 200), now 204 No Content on success and a 500 Hydra Error when deletion fails.
3. Three Customer wire keys are renamed by trimming a trailing space that has been in the serialised name: "administrator " → "administrator", "created " → "created", "acceptedAgreement " → "acceptedAgreement". Any consumer that coded around the bug (requesting the spaced key) must switch; please check the portal before merging.
4. Minor: PUT /customers/{id}/customHeaders/{headerId} on an existing header returned 201 Created (a handler bug, unchanged since 2023); it now returns 200 OK. 201 is still returned when a PUT creates.

Items 1, 2 and 4 are the ratified status-code conventions applied (refs #1050); item 3 closes the whitespace-property-name defect and adds a reflection guard test (DLCS.Hydra.Tests) so it cannot recur.

The ratified conventions, for context: every DELETE returns 204 No Content with an empty body (404/409/500 as Hydra Error); create-POSTs return 201 + Location (named action-POST exceptions: API-key creation, application setup — return 200); PUT upserts return 201 on create / 200 on replace, update-only PUTs annotate exactly what they do; every non-2xx response is a Hydra Error; error annotations always declare Type = typeof(Error); no Hydra property name carries whitespace.

Non-breaking commits (annotations / generated vocab / internal tidy-ups only):

• XC-04 — DefaultDeliveryChannelsController create POST's catch-all returned a bare empty BadRequest(); now a Hydra Error 400. Internal tidy-up: TryValidateHydraDeliveryChannelPolicy returns null-when-valid instead of an Ok() sentinel.
• XC-05 sweep — 24 bare error-status [ProducesResponseType] annotations across 9 controllers gain Type = typeof(Error), matching the actual HydraProblem bodies.
• ACC-14 (via XC-02) — key-creation Hydra operation metadata claimed 201; the wire (sanctioned exception) returns 200; metadata now matches.
• XC-03 — custom-header PUT annotates its 404 (update-only PUT annotates exactly what it does).
• SPA-13 / SPA-19 — CustomerOriginStrategy no longer advertises a PATCH operation or a credentials PUT sub-resource that don't exist.
• SPA-12 — origin-strategy Hydra attributes corrected to the documented contract (strategy settable; credentials write-only property; requiresCredentials read-only).

Integration tests updated for the changed status codes; API, API.Tests and DLCS.Hydra.Tests build clean; DLCS.Hydra.Tests pass (20/20) including the new guard test.

🤖 Generated with Claude Code