docs: DELETE /api/fonts/:id endpoint missing from behaviors.md (API-020)

[evan-zhang11]

Problem

The font deletion endpoint DELETE /api/fonts/:id is implemented in backend/src/font_handlers.rs (handler delete_font) and registered in backend/src/routes.rs, but is not documented in any behavior contract entry in docs/dev/behaviors.md.

Current Font API Documentation

ID	Covers
API-020	POST /api/fonts (upload) + GET /api/fonts / GET /api/fonts/:id (list/get)
API-021	POST /api/fonts/:id/publish + POST /api/fonts/:id/unpublish
API-022	GET /fonts/:workspaceSlug/:fontstack/:range (public glyphs)

Missing: DELETE /api/fonts/:id

Implementation Details (from delete_font handler)

• Authentication: Required
• Workspace isolation: Filters by currentWorkspaceId
• Behavior:
  1. Looks up glyphs_path for the font in the current workspace
  2. Returns 404 if font not found (or not in workspace)
  3. Deletes the DB record from fonts table
  4. Attempts filesystem cleanup: removes the font directory (remove_dir_all)
  5. Path traversal protection: canonical path checked against upload_dir_canonical
• Response: 204 (no content)
• Errors: 401 (unauthenticated), 404 (not found)

Proposed Action

Either extend API-020 to cover deletion, or add a new entry (e.g., API-020a) documenting:

• The DELETE method on /api/fonts/:id
• Expected 204 response
• Workspace isolation behavior
• Filesystem cleanup behavior
• Error responses

Priority: P2 — The endpoint works correctly but lacks documentation. Low risk since it follows the same pattern as other delete endpoints.