Add soft-delete state

To prepare for application expiration and eventual deletion (#2682 ), we need to introduce a new soft delete state.

- [ ] Add a new soft-delete application state.
- [ ] Implement an API endpoint/action to set an application to soft-delete.
- [ ] Soft-delete should be the first step before permanent deletion.

Start by locating the application state definitions and the existing expiration or permanent-deletion flow referenced by issue #2682. Trace how application actions are exposed through the API, then verify that soft-delete can be requested and is the first state transition before permanent deletion.

Written by the indexing model from the issue text.