Activate mutating mosaic-on-demand routes (POST /create, DELETE /{name})

[jakobtfaber]

What to build

Activate the mutating subset of dsa110_continuum/mosaic/api.py's REST surface so users can trigger mosaic builds and delete user-created mosaics over HTTP:

• POST /mosaics/create
• DELETE /mosaics/{name}

These routes trigger compute (mosaic.pipeline.execute_mosaic_pipeline_task) and mutate state, so they are gated on the auth posture ADR. Apply the auth model chosen there before exposing.

Acceptance criteria

• Mutating routes accessible only to authenticated users per the model chosen in the auth ADR.
• POST /mosaics/create successfully kicks off a mosaic build that appears in the navigation tree with lifecycle = running.
• DELETE /mosaics/{name} is restricted to user-created mosaics — does NOT delete pipeline-produced epoch mosaics.
• Audit trail: every mutating request is logged with caller identity and timestamp.
• End-to-end test exercising create → status poll → fits download → delete.

Blocked by

#49, #58