feat(backthink/admin): ③b — rag/delete 真实现 + D1 推送出口钩子(自建优先→个推兜底) + api-reference 补 D2/D3/D5 补丁

- B5: POST /admin/rag/delete 真做(DeleteDocument→DeleteProject 级联删章节+索引清理, owner+审计, 200/404/500, 500降级兜底); users/iot scenarios+rules 诚实501(无用户表/IoT场景规则模型, 消息写明缺什么, 不伪造), 锁住 501+not_implemented
- D1: backthink/push_outlet.go PushExporter{Export}; pushOutlet 自建HTTP(2xx=送达, token仅Authorization头+error脱敏)优先→Getui兜底(未接入, 诚实日志'getui not integrated'+(false,nil)); backthink.Deps.Exporter → pusher.withExporter, Push 在WS/IM后 exportAsync(detached+5s超时, 失败仅日志, 不破坏现有投递, 限流不上报); config PushOutletConfig(PUSH_EXPORTER_* + GETUI_*占位)
- 前端 Rag.tsx/api.ts 删除后 reload + 类型; Docs/api-client v0.31 + api-reference(#23 owner/200-404, §8.4, 端点表PATCH/DELETE messages + pinned + messages?q=)
- 测试(push_outlet/admin_rag_delete/admin_honest501/knowledge store), 后端+前端build全绿+3平台交叉编译
- 刻意: Getui SDK 未接入(无SDK不硬造), 主人自建服务填 PUSH_EXPORTER_URL/TOKEN 即可

internal/services/gateway/server.go

@@ -235,9 +235,11 @@ type OwnerRegistrar interface {
 }
 
 // RagStore backs the admin knowledge-base RAG module (design/10 §3.12 module 8).
-// *runtime/knowledge.Store is the production implementation. Every method is
-// read-only for this milestone: IndexDocument/DeleteDocument return a clear
-// "write lands in M10" error rather than a fabricated success.
+// *runtime/knowledge.Store is the production implementation: it lists/searches
+// the project index, imports a document (chunk + index) and deletes one
+// (project entry + cascaded chapters). An implementation that cannot write
+// reports a clear error (knowledge.ErrWriteUnsupported) rather than a fabricated
+// success; the handlers map a missing document to 404.
 type RagStore interface {
 	// ListDocuments enumerates the knowledge-base documents (project-index
 	// entries).
@@ -245,9 +247,10 @@ type RagStore interface {
 	// Search answers a knowledge-base query (line-level hierarchy + optional
 	// semantic/vector ranking).
 	Search(ctx context.Context, query string) ([]knowledge.Hit, error)
-	// IndexDocument uploads/chunks/embeds a document. M10; returns an error.
+	// IndexDocument uploads/chunks/embeds a document into the project index.
 	IndexDocument(ctx context.Context, doc knowledge.Doc) error
-	// DeleteDocument removes a document. M10; returns an error.
+	// DeleteDocument removes a document (and its chapters) by id, returning
+	// knowledge.ErrDocumentNotFound when no such document exists.
 	DeleteDocument(ctx context.Context, id string) error
 }
 
@@ -509,7 +512,6 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /api/v1/admin/backthink", adminAuth(http.HandlerFunc(s.adminListBackthink)))
 	mux.Handle("GET /api/v1/admin/rag", adminAuth(http.HandlerFunc(s.adminListRag)))
 	mux.Handle("POST /api/v1/admin/rag/query", adminAuth(http.HandlerFunc(s.adminSearchRag)))
-	mux.Handle("POST /api/v1/admin/rag/delete", adminAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("GET /api/v1/admin/observability/metrics", adminAuth(http.HandlerFunc(s.adminObservabilityMetrics)))
 	mux.Handle("GET /api/v1/admin/observability/trace", adminAuth(http.HandlerFunc(s.adminObservabilityTrace)))
 	mux.Handle("GET /api/v1/admin/observability/audit", adminAuth(http.HandlerFunc(s.adminObservabilityAudit)))
@@ -549,6 +551,7 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/v1/admin/memories", ownerAuth(http.HandlerFunc(s.adminAddMemory)))
 	mux.Handle("POST /api/v1/admin/memories/search", ownerAuth(http.HandlerFunc(s.adminMemorySearch)))
 	mux.Handle("POST /api/v1/admin/rag", ownerAuth(http.HandlerFunc(s.adminIndexRag)))
+	mux.Handle("POST /api/v1/admin/rag/delete", ownerAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("GET /api/v1/admin/sessions/{id}/export", adminAuth(http.HandlerFunc(s.adminExportSession)))
 	mux.Handle("POST /api/v1/admin/system/revoke-keys", ownerAuth(http.HandlerFunc(s.adminRevokeAllKeys)))
 	mux.Handle("POST /api/v1/admin/system/rotate-jwt", ownerAuth(http.HandlerFunc(s.adminRotateJWT)))