Stage 3: enforce blob deletion ownership and add admin representation deletion

Also repairs two stale Phase 21 fixtures:
- Supplies a valid PDF to exercise the upload dependency-failure path.
- Injects getPersonalAccount into the representation-involvement VM fixture.

docs/administrative-authentication.md

@@ -70,10 +70,9 @@ independent administrative-session authorization. A later authorised stage
 must enforce the administrative session on privileged API routes and account
 for both browser calls and the existing server-side bootstrap callers.
 
-Storage download, representation editing, queue actions, and draft deletion
-also retain their existing authorization behaviour in this stage. In
-particular, the original cross-container deletion risk is not remediated by the
-administrative page login and remains a separate mitigation boundary.
+Storage download, representation editing, and queue actions retain their
+existing authorization behaviour. The other administrative API and storage
+limitations described in this section remain open.
 
 Directly observed storage routes include:
 
@@ -83,8 +82,29 @@ Directly observed storage routes include:
   visible administrative-session or HMAC check.
 - `/api/file/downloadblob` and `/api/file/createrepcompletemessage_api`, which
   enforce existing path-HMAC checks but not administrative authorization.
-- `/api/file/deleteblobcase` and `/api/file/deleteblobrep`, whose existing
-  cross-container deletion behaviour is intentionally unchanged in this stage.
+
+## Stage 3 deletion controls
+
+Ordinary case and representation deletion through `/api/file/deleteblobcase`
+and `/api/file/deleteblobrep` now requires a valid NextAuth session whose user
+ID matches the requested Azure container. The existing signed-query/HMAC check
+also remains required. Requests that fail ownership or HMAC validation are
+rejected before the Azure storage deletion operation is called.
+
+Administrative cross-container representation deletion uses the dedicated
+`POST /api/admin/deleteblobrep` route. That endpoint independently validates
+the administrative session and requires a trusted same-origin request. It also
+validates the requested container, case-folder segment, and representation-file
+segment before performing deletion.
+
+Administrative case deletion was not investigated or remediated as part of
+Stage 3 and remains a separate, unverified security boundary. The other
+administrative API and storage limitations documented above also remain open.
+
+Automated contract verification for the implemented deletion controls has
+passed. Live Azure behaviour, browser-level behaviour, and deployment
+configuration have not been verified by that automated coverage. These changes
+do not establish closure of the overall ITHC finding.
 
 ## Deployment requirements before production use