Slice 3 (Module 03): Slot deletion with booked guard

[mGasiorek998]

What to build

Let a doctor delete their own free slots with a per-row delete button on /doctor/slots. Slots in booked status must not be deletable — both the API and the UI enforce this so a doctor can never silently cancel a confirmed appointment.

• Fill in doctorContract with deleteSlot.
• DELETE /doctors/{doctorId}/slots/{slotId} behind requireAuth() + requireRole(['doctor']) plus an ownership check: 403 if doctorId ≠ JWT sub.
• Returns 204 on successful deletion; 404 SLOT_NOT_FOUND if the slot does not exist; 409 SLOT_BOOKED if its status is booked.
• Structured INFO log on every successful deletion (acting doctor id, slot id).
• Per-row delete button on /doctor/slots: hidden or disabled-with-tooltip ("Booked slots cannot be deleted") for booked rows; on success removes the row from the list (TanStack Query invalidation).

Acceptance criteria

• DELETE /doctors/{doctorId}/slots/{slotId} removes a free slot owned by the caller and returns 204.
• DELETE … on a slot with status booked returns 409 SLOT_BOOKED and leaves the row in place.
• DELETE … where doctorId does not match the calling user returns 403 (cross-doctor tampering blocked).
• DELETE … for a non-existent slot returns 404 SLOT_NOT_FOUND.
• DELETE … returns 401 without JWT and 403 with a patient JWT.
• The delete button on /doctor/slots is disabled (or absent) for booked slots and removes the row on success.
• pnpm verify exits 0.

User stories covered

• US Slice 2: Login + role-aware dashboard happy path #6: As a doctor, I want to delete a slot I published, so that I can remove availability windows I no longer want to offer.
• US fix: api-client doubles base URL in fetch call #7: As a doctor, I want the system to prevent me from deleting a slot that a patient has already booked, so that I cannot silently cancel a confirmed appointment.
• US Slice 4 (Module 02): Doctor "Shared with me" view + document download #12: As a doctor, I want to be blocked from modifying or deleting slots belonging to a different doctor, so that cross-doctor tampering is impossible.

Blocked by

• Slice 2a (Module 03): Slot table + list-own + read-only slot management page #20