- Fix TOCTOU race: confirm now requires pubkeys from preview in request
body; server intersects with still-outside nodes so exactly the
previewed set is deleted (no more, no less)
- Add cascade comment to DeleteNodesByPubkeys documenting that only the
nodes table is affected (no FK constraints today)
- Log each deleted node by name + pubkey for operator visibility
- Return deleted node list in confirm response so UI shows what happened
- Check lat/lon nil directly instead of passing 0.0 to NodePassesGeoFilter
- Update confirm test to send pubkeys body; add test for missing body → 400
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>