🐛(delete) delete may target the wrong index when a service has sub-services #173

Problem

DeleteDocumentsView picks the target index this way (views.py#L229-L231):

index_name = get_opensearch_indices(audience, services=[params.service])[0]

get_opensearch_indices returns one index per allowed service, built from a set (the services filter isn't applied), not the requested one. As soon as the calling service has sub-services ("Allowed services for search"), [0] is an arbitrary index in set-iteration order. The delete can then run on a different service's index than params.service.

Permissions still apply (the caller's sub must be in users), so this isn't an escalation. But deletions can silently do nothing, or hit the wrong service's index.

The existing tests in test_api_documents_delete.py only create one service with no sub-services, so they can't catch this.

Expected

Delete always targets get_opensearch_index_name(params.service) once the service is validated. Add a test with a service that has sub-services.