[REQ-postpone-14] Postpone delete/admin cleanup until ownership exists

[Yael-work]

Forged admin delete header is real, but removing it alone breaks regular-user delete (DELETE /meals/:id is admin-only). Fold the proper fix into the DB ownership work (REQ-a4-ai-04 derives owner from auth). Not graded in A4.