feat(project-cleanup): classify delete outcomes in four categories

[kallioli]

Context

The run shown in the previous PR produced 62 delete attempts, of which:

• 30 servers succeeded,
• 1 volume succeeded,
• 11 volumes were already gone (cascaded by their parent server's deletion with delete_on_termination=True),
• 12 volumes were in a transient detaching state (400 "status must be available"),
• 1 router + 1 network were blocked by a still-attached port (409, addressed in PR fix(project-cleanup): robust router + network teardown #1).

Historically every non-2xx was shown as a red ✗. Operators couldn't tell at a glance whether the cleanup was functionally successful, partially blocked, or actually broken — everything looked like failure.

Changes

• New Outcome enum: SUCCESS, ALREADY_GONE, BLOCKED, FAILED.
• _delete_one now returns an Outcome instead of a bool, and classifies APIError by status_code:
  • 404 → ALREADY_GONE (idempotent success — a cascade already removed the resource),
  • 409 → BLOCKED (dependency conflict, typically retryable or fixable by re-ordering),
  • anything else (400, 500, transport errors, unexpected exceptions) → FAILED.
• Per-line markers:
  • ✓ green — SUCCESS
  • ~ cyan with (already gone) — ALREADY_GONE
  • ⊘ yellow — BLOCKED
  • ✗ red — FAILED
• Trailing summary replaces the single X/Y deleted counter with all four buckets:

  23 deleted · 15 already gone · 2 blocked · 1 failed (of 41)
  

• 13 new tests covering: status-code classification (parametrized), all four _delete_one paths, and an end-to-end Click test asserting the four-bucket summary.

Behaviour unchanged

• Exit code remains 0 regardless of the outcome mix, to avoid breaking scripts that already use orca project cleanup --yes in a pipeline. Wiring a non-zero exit on FAILED > 0 can be a follow-up once users have adapted to the new categories.
• Router / network / volume delete logic is not touched here — PR fix(project-cleanup): robust router + network teardown #1 handles the actual delete correctness.

Tests

• ruff check .
• mypy
• pytest — 2291 passed
• coverage 88.29% (gate 85%)

Risks

• Non-APIError exceptions (library bugs, unexpected KeyError, …) still fall into FAILED, as before. This preserves the blast-radius scope of the classification to known HTTP semantics.
• The unicode markers (~, ⊘) are stable across the terminals orca already supports (rich handles fallback); no regression observed on the existing rich output tests.