test(security): add 403 permission test for annotation DELETE endpoint

Confirms that DELETE /api/documents/{id}/annotations/{id} requires at
least ANNOTATE_ALL; a user with only READ_ALL receives 403 Forbidden.
Closes the permission audit raised during PR review.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/org/raddatz/familienarchiv/controller/AnnotationControllerTest.java

@@ -154,6 +154,13 @@ class AnnotationControllerTest {
                 .andExpect(status().isForbidden());
     }
 
+    @Test
+    @WithMockUser(authorities = "READ_ALL")
+    void deleteAnnotation_returns403_whenUserHasOnlyReadAllPermission() throws Exception {
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
+                .andExpect(status().isForbidden());
+    }
+
     @Test
     @WithMockUser(authorities = "ANNOTATE_ALL")
     void deleteAnnotation_returns204_whenHasAnnotatePermission() throws Exception {

frontend/src/lib/components/AnnotationShape.svelte

@@ -130,8 +130,8 @@ let shapeStyle = $derived(
 			}}
 			style="
 				position: absolute;
-				top: -8px;
-				right: -8px;
+				top: 4px;
+				right: 4px;
 				min-width: 44px;
 				min-height: 44px;
 				display: flex;

frontend/src/lib/components/AnnotationShape.svelte.spec.ts

@@ -113,6 +113,28 @@ describe('AnnotationShape', () => {
 		expect(onDeleteRequest).toHaveBeenCalledOnce();
 	});
 
+	it('does not call onclick when delete button is clicked', async () => {
+		const onclick = vi.fn();
+		const onDeleteRequest = vi.fn();
+
+		render(AnnotationShape, {
+			annotation: makeAnnotation(),
+			isHovered: true,
+			isActive: false,
+			showDelete: true,
+			onDeleteRequest,
+			onclick,
+			onpointerenter: () => {},
+			onpointerleave: () => {}
+		});
+
+		const deleteBtn = page.getByTestId('annotation-delete-ann-1');
+		await deleteBtn.click();
+
+		expect(onclick).not.toHaveBeenCalled();
+		expect(onDeleteRequest).toHaveBeenCalledOnce();
+	});
+
 	it('calls onDeleteRequest when Delete key is pressed on the annotation', async () => {
 		const onDeleteRequest = vi.fn();
 

frontend/src/routes/documents/[id]/+page.svelte

@@ -120,7 +120,10 @@ async function handleAnnotationDeleteRequest(annotationId: string) {
 		await deleteBlock(block.id);
 	} else {
 		// Annotation has no linked block — delete the annotation directly
-		await fetch(`/api/documents/${doc.id}/annotations/${annotationId}`, { method: 'DELETE' });
+		const res = await fetch(`/api/documents/${doc.id}/annotations/${annotationId}`, {
+			method: 'DELETE'
+		});
+		if (!res.ok) throw new Error('Delete annotation failed');
 		annotationReloadKey++;
 	}
 }