PersonService.search maps a PersonFilter to the paired slice/count repository queries and returns a PersonSearchResult with a server-side total. confirmPerson clears the provisional flag (the state transition behind PATCH /confirm). deletePerson detaches sender/receiver document references before the hard delete so it cannot orphan an FK. Refs #667 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>