Verify the caller owns the DID by resolving their PDS via plc.directory and validating the session token before allowing note deletion. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
