Canonicalize the `delete_in_root` payload

[devangb3]

• Why it matters: delete_service.py:14-18 accepts delete_in_root as bool or "true"/"false". The frontend only ever sends a boolean, so the string branch is dead defensive code. Defensive branches hide real bugs (malformed requests silently succeed).
• Current state: backend/delete_service.py:14-18.
• Proposed implementation: Require a bool; return 400 otherwise. Remove the isinstance branch.
• Files affected: backend/delete_service.py.
• Acceptance criteria: Malformed payload returns 400; no isinstance(..., str) remains in the function.