[DEF-005] DashboardPoamEndpoints — DELETE /api/dashboard/poam/{poamId} not wired; PoamService.DeleteAsync exists but unreachable

## Summary

`DashboardPoamEndpoints.cs` maps GET, POST, PUT, and component-link/unlink-task routes but has no `MapDelete` for the top-level POA&M item. `PoamService.DeleteAsync` is implemented in the service layer but is never called via REST — the delete capability is entirely unreachable.

## Location

- `src/Ato.Copilot.Mcp/Endpoints/DashboardPoamEndpoints.cs`
- Routes present: GET, POST, PUT, component-link, unlink-task
- **Missing:** `MapDelete /api/dashboard/poam/{poamId}`
- `PoamService.DeleteAsync` — implemented but not wired to any endpoint

## Severity

**MEDIUM** — POA&M items cannot be deleted via the API. Orphaned items accumulate and cannot be cleaned up through normal REST operations.

## Steps to Reproduce

\`\`\`bash
curl -X DELETE https:///api/dashboard/poam/{poamId} \
-H "Authorization: Bearer ..."
# Expected: 200 or 204
# Actual: 404 Not Found (no route registered)
\`\`\`

## Fix Direction

Add `app.MapDelete("/api/dashboard/poam/{poamId}", ...)` in `DashboardPoamEndpoints.cs` calling `PoamService.DeleteAsync`.

> **Note:** This is a distinct issue from #629 ([BUG] POA&M page renders blank), which is a frontend rendering problem. This issue is the missing backend DELETE endpoint.

## Evidence Source

- War Machine CRUD inventory `73e2e825caab4903` — POA&M delete marked 🔴
- Star-Lord QA audit `84b7431961aa4750`
- Banner consolidated findings `539e6ef45fe842b8`

Start in src/Ato.Copilot.Mcp/Endpoints/DashboardPoamEndpoints.cs and compare the existing GET, POST, PUT, component-link, and unlink-task mappings. Trace PoamService.DeleteAsync, then verify that DELETE /api/dashboard/poam/{poamId} invokes it and returns a successful 200 or 204 response instead of 404.

Written by the indexing model from the issue text.