[Board] Boards are tombstoned, never deleted

[KacperKozak]

Deleting a Board now stamps deleted_at instead of removing its row, so the rides it produced keep a Board identity that still resolves. Board-owned configuration is still hard-deleted, and Ride History is untouched, exactly as before.

Note

Risk: Medium — changes deletion semantics and the Board read paths on both platforms.
Complexity: Medium — small surface, but the list/lookup split and the no-resurrect rule have to hold identically in Room and GRDB.
DB: Migration — additive nullable boards.deleted_at (Room 36 → 37, GRDB v37_board_deleted_at); existing rows upgrade as live.

Tasks

• [Board] Verify Board tombstoning on dev #428

Description

Ride History outlives the Board that produced it. The app has always kept telemetry after a Board delete, but the boards row vanishing left those rides pointing at an id that resolved to nothing, so history could only fall back to the device_name snapshotted on each row — a frozen label, not an identity. A tombstone keeps the row resolvable.

The rule is a deliberate split: getBoards() filters deleted_at IS NULL, so a tombstone is gone from every rider-facing list, while getBoard(id) resolves tombstones on purpose, because history still has to name a deleted Board. Anything that acts on a Board rather than describing one — building a session config for a connect — checks the stamp and refuses. Deletion is terminal: an ordinary upsert from the bridge carries an existing tombstone forward rather than clearing it, and deleting an already-tombstoned Board is a no-op, so the stamp never moves.

The decision, its rejected alternatives and its consequences are in docs/adr/0027-boards-are-tombstoned-never-deleted.md.

This slice was specified in #279 and implemented on the unmerged sync branch behind #276, which left dev still hard-deleting. It is extracted here without the sync half — no sync_seq, no delete-action log, no server contract; those stay with #276 and will need reconciling when it merges, since it carries its own deleted_at at a different migration number.

Making Board identity resolvable is the prerequisite for the identity half of #274 — putting board_id on the telemetry tables so history stops relying on the denormalized device_name. That remains a separate slice, and device_name is deliberately untouched here: telemetry keys on the BLE id, not the Board id, and boards hard-deleted by earlier versions are already gone, so that label is still the only one some existing rides have.

Closes #428

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}