fix(api): deleting a plan leaves its pending step rows uncapped on token approval #862

Problem

purchase_executions.plan_id is ON DELETE SET NULL (migration 000033). Since #859 (task D1 of #631), token approval of a plan-step row applies the plan's max_step_commitment (requirePlanStepCap in internal/api/handler_purchases.go) only when execution.PlanID != "". If the plan is deleted while a plan-step row is still pending, the row's plan_id becomes NULL. A token approver who holds no approve verb (for example the account's contact_email) can then approve the row with no cap check.

The approve-own branch in enforceHeldApproveConstraints also keys on PlanID != "", so an approve-own holder's Constraints stop applying to the orphaned row too.

Expected

Deleting a plan does not widen what its pending step rows can be approved for. Options: cancel or expire pending plan-step rows when their plan is deleted; or mark plan-step rows with a column that survives plan deletion (for example step_number set / a dedicated flag) and refuse token approval of an orphaned plan-step row.

Notes

Found during the gate review of #859. It was out of scope there and does not block that PR. Today it needs a user with permission to delete plans, so it widens an approval but does not let a caller with no access approve.