Fix FAT dashcam file deletion

Co-authored-by: Copilot <[email protected]>

PLAN.md

@@ -845,8 +845,16 @@ Phase 15 shared list component:
   regression behavior, and cleanup-failure reporting against temporary filesystem fixtures.
   Deployed to the Pi; the live API correctly returned no storage devices while ignoring the
   attached PL2303 OBD adapter, and the responsive browser UI passed no-device and mocked populated
-  list/sort/confirmation/delete tests. Actual deletion from the physical dashcam remains a
-  hardware verification item for the next time it is connected in USB storage mode.
+  list/sort/confirmation/delete tests.
+- **Real-hardware deletion verification (2026-08-09)**: connected the 29.7GB FAT dashcam and listed
+  all 87 original videos (29,615,111,758 bytes) through the live API. The first controlled delete
+  exposed that FAT files were root-owned despite the read-write remount, so unprivileged
+  `os.remove()` failed; added a privileged `sudo rm -- <validated-path>` fallback only after the
+  existing extension, realpath, and mount-boundary checks pass. Created and deleted a tiny
+  disposable `YARIS_OBD_DELETE_TEST.MP4` twice through the real API. Both cycles returned exactly
+  to the original 87-file count and byte total, left every real video untouched, unmounted
+  `/mnt/dashcam`, and kept the service active. Bulk delete uses the same validated per-file removal
+  path but was not run against the real card because it would intentionally erase all footage.
 
 ### Phase 17: Local imported-video browser + player — 🚧 PLANNED
 Same file-browser treatment for videos already imported to the Pi's own disk