feat: support permanent vault trash deletion

internal/api/app.go

@@ -1098,6 +1098,20 @@ func (a *App) RestoreVaultTrash(pluginID, trashID string, options corefiles.Rest
 	return restoredPath, ""
 }
 
+// DeleteVaultTrash permanently removes an internal trash entry for a plugin with files.delete.
+func (a *App) DeleteVaultTrash(pluginID, trashID string) string {
+	if _, err := a.requirePluginAccess(pluginID, "files.delete"); err != nil {
+		return err.Error()
+	}
+	if a.files == nil {
+		return "files service not initialized"
+	}
+	if err := a.files.DeleteTrashEntry(trashID); err != nil {
+		return err.Error()
+	}
+	return ""
+}
+
 // OpenVaultPathExternal opens a vault-relative file or folder in the OS default app.
 func (a *App) OpenVaultPathExternal(pluginID, relativePath string) string {
 	if _, err := a.requirePluginAccess(pluginID, "files.openExternal"); err != nil {

internal/api/app_test.go

@@ -436,6 +436,21 @@ func TestFilesBridgeReadWriteListMoveTrash(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(root, "Docs", "two.txt")); err != nil {
 		t.Fatalf("restored file missing: %v", err)
 	}
+
+	permanent, errStr := app.TrashVaultPath("files.plugin", "Docs/two.txt")
+	if errStr != "" {
+		t.Fatalf("TrashVaultPath before permanent delete: %s", errStr)
+	}
+	if errStr := app.DeleteVaultTrash("files.plugin", permanent.TrashID); errStr != "" {
+		t.Fatalf("DeleteVaultTrash: %s", errStr)
+	}
+	trashEntries, errStr = app.ListVaultTrash("files.plugin")
+	if errStr != "" {
+		t.Fatalf("ListVaultTrash after permanent delete: %s", errStr)
+	}
+	if len(trashEntries) != 0 {
+		t.Fatalf("trash entries after permanent delete = %+v, want none", trashEntries)
+	}
 }
 
 func TestFilesBridgeWritePublishesFileChangedActivityEvent(t *testing.T) {
@@ -707,6 +722,12 @@ func TestFilesBridgePermissions(t *testing.T) {
 			},
 			wantPhrase: "files.write",
 		},
+		{
+			name:       "permanent trash delete requires delete",
+			perms:      []string{"files.read", "files.write"},
+			call:       func(app *App) string { return app.DeleteVaultTrash("files.plugin", "missing") },
+			wantPhrase: "files.delete",
+		},
 		{
 			name:       "open external requires openExternal",
 			perms:      []string{"files.read", "files.write", "files.delete"},