Deleting an instrument record leaves an orphaned session, and no endpoint can delete a session #1883

Problem

Deleting an instrument record leaves its session in the database, and no endpoint can delete a session.

• InstrumentRecordsService.deleteById (apps/api/src/instrument-records/instrument-records.service.ts) deletes the record and its files only.
• SessionsController has only POST /sessions and GET /sessions.
• The only path that deletes sessions is DELETE /subjects/:id?force=true, which deletes the whole subject.

Every session created by the bulk upload or by a form holds exactly one record, so each record delete leaves an empty session. These sessions:

• count toward GET /summary counts.sessions and its trend,
• appear in the session list and the subject's session history,
• cannot be removed by an admin without direct database access.

Observed

On a production instance (v2.5.2), a cleanup of about 26,000 duplicate bulk-uploaded records through DELETE /instrument-records/:id would leave about 26,000 empty sessions. Before any cleanup, that instance already has 79 sessions with no record.

Options

1. In deleteById, also delete the record's session in the same transaction when no other record references it.
2. Add DELETE /sessions/:id (@RouteAccess({ action: 'delete', subject: 'Session' })), rejected while the session still has records.
3. Both.

Option 1 stops new orphans. Option 2 (or a one-off migration) is still necessary to remove the sessions that are already orphaned.