fix(blocks): one block definition service for delete, rename and purge on every path

new src/scene/block_service.rs (references, delete, rename, purge candidates, name validation, one error type and message). The command-line RENAME, palette Remove, plugin API, control/MCP block_delete and PURGE all use it. Layout, xref, dynamic-block, anonymous and open-in-editor records are protected; PURGE removes an anonymous block only when nothing references it. PROTOCOL CHANGE: control/MCP block_delete refuses a referenced block unless force=true (erases referencing INSERTs in one undo step). New REST route DELETE /api/v1/blocks/{name}?force=true. MCP tool digest re-pinned. Undo labels are Delete block X, Rename block X to Y and Purge.

docs/automation/API-SPEC.md

@@ -316,10 +316,10 @@ registry with write rules), `properties`, `measure` (length/area/bounds),
 | Op | Fields | Semantics |
 |---|---|---|
 | `block_define` | `name`, `base:[x,y,z]`, `handles`, optional `insert_at`, optional `"replace":true` | The sources move into the new definition (flattened at `base` = block origin) and one `Insert` is placed at `insert_at` (default `base`), so the drawing looks unchanged. `"replace":true` drops a same-named definition — children, markers and inserts — inside the same undo step before creating the new one (idempotent re-import). Result `{"block":name,"insert":"<handle>"}`. Names are unique, `*` is reserved. |
-| `block_delete` | `name` | Removes the definition completely: child entities, block markers, every `Insert` referencing it and the table record. One undo step. Result `erased`. Unknown → `block_missing`; `*`-records → `block_protected`. |
+| `block_delete` | `name`, optional `"force":true` | Removes the definition completely: child entities, block markers and the table record. One undo step (`Delete block <name>`). A referenced block is refused (`block_referenced`); `"force":true` erases the referencing INSERTs in the same step and reports `result.references`. Result `erased`. Unknown → `block_missing`; layout/anonymous/xref/dynamic records → `block_protected`; open BEDIT session → `block_in_edit`; invalid/taken names → `block_invalid_name` / `block_exists`. |
 | `wblock` | `path`, `handles` *or* `block`; optional `"template":"<file>"` (the export inherits that file's tables/styles), optional `"normalize":true` (the export is shifted so its overall bounds minimum lands on the origin) | Writes a standalone DWG/DXF (extension decides). The source document is untouched. Result `{path, entities, normalized}`. |
 
-REST: `POST /blocks`, `DELETE /blocks/{name}`, `POST /wblock`.
+REST: `POST /blocks`, `DELETE /blocks/{name}` (add `?force=true` to erase the referencing INSERTs instead of being refused), `POST /wblock`.
 
 ### 6.6 Layouts and plotting
 

docs/automation/README.md

@@ -701,9 +701,15 @@ definition — its children, markers and inserts — inside the same undo step
 before creating the new one: that is SPM's barcode re-import flow, so
 `block_define` never fails with "already exists" on a re-import.
 `block_delete` removes a definition completely (children, Block/BlockEnd
-markers, every Insert referencing it and the table record) and reports
-`result.erased`; unknown names are `block_missing`, `*`-prefixed layout
-records are `block_protected`. Definitions survive save/open round trips
+markers and the table record). A definition anything still points at — an
+INSERT, a dimension-style arrow block, a multi-leader's block content — is
+refused with `block_referenced` and the shared message text; add
+`"force":true` to erase the referencing INSERTs in the same undo step and get
+`result.references` with the number that were overridden. `result.erased`
+counts every entity the step removed. Unknown names are `block_missing`,
+`*`-prefixed layout records, anonymous and xref definitions are
+`block_protected`, and a block with an open BEDIT session is `block_in_edit`.
+Definitions survive save/open round trips
 and are consumable by `wblock` (by block name) and `INSERT` creation via
 `entities_create`.