Problem

DELETE /sessions/{session_id} only succeeds when the session exists in memory.

Current delete_session() behavior:

• removes in-memory session
• deletes persisted JSON only if the in-memory entry was found
• returns False for disk-only sessions

This means a valid persisted session file can remain undeletable through the API when it is not currently loaded in memory.

Why this matters

The endpoint contract says deleting a session should remove its persisted data as well. For disk-only sessions (for example after partial restore conditions), delete should still work.

Expected behavior

• If a session exists on disk, delete_session() should delete the file and return success, even when no in-memory entry exists.

Proposed fix

• In api/services/memory.py, update delete_session() to attempt disk deletion independently of in-memory deletion.
• Return True when either in-memory or persisted state was deleted.
• Add unit regression test for disk-only session deletion path.

Scope / non-overlap

• Focused session lifecycle bugfix only.
• Complements (does not overlap with) malformed-session restore hardening ([Bug] Corrupted persisted session JSON can break session restore on startup #304/fix: harden session restore against malformed persisted JSON (fixes #304) #305).