[TASK] Implement delete contentlets endpoint

Description

Implement DELETE /v1/maintenance/_contentlets in MaintenanceResource.java. Takes a list of contentlet identifiers, retrieves all language siblings for each, and permanently destroys them (bypasses trash).

Acceptance Criteria

• API caller must provide a list of contentlet identifiers in JSON body
• For each identifier, endpoint must retrieve all language siblings via ContentletAPI.getSiblings(identifier)
• Endpoint must permanently destroy each contentlet via ContentletAPI.destroy(contentlet, user, true)
• API caller must receive the count of successfully deleted contentlets
• API caller must receive a list of identifiers that failed to delete (e.g., not archived)
• Must require CMS Administrator role and Maintenance portlet access
• API caller must receive 400 Bad Request if identifiers list is empty

Priority

None

Additional Context

• destroy() is a permanent delete — no recovery. Different from delete() which archives
• getSiblings() returns all language variants for a given identifier — all siblings are destroyed together
• The DWR version takes a comma-separated string; the REST endpoint should accept a JSON array
• DWR legacy: CMSMaintenanceAjax.deleteContentletsFromIdList() lines 184–220

Start in MaintenanceResource.java and compare the DWR legacy implementation in CMSMaintenanceAjax.deleteContentletsFromIdList() at lines 184–220. Verify the endpoint accepts a JSON identifier list, retrieves siblings and permanently destroys them with the required access checks, then confirm the response includes deletion and failure results and rejects an empty list with 400 Bad Request.