lib: one cascade graph for every store

[aberoham]

Destroy a group on json or toml and its nameservers stay behind. Same for a
user's sessions and a zone's records. mysql removes all three, because it has a
constraint and the file stores have nothing.

Measured on 96f4799 through lib/<entity>/index.js, one fixture per pair:

destroy	child	constraint	mysql	json	toml
group	nameserver	nt_nameserver_ibfk_1	gone	stays	stays
user	session	nt_user_session_ibfk_1	gone	stays	stays
zone	zone_record	nt_zone_record_ibfk_1	gone	stays	stays

Each backend decided this on its own: mysql reads it off a FOREIGN KEY, the file
stores never implemented it. Their destroy() is the whole story — filter own
array, save, return; group, user and zone are the same method over a different
array.

references.js says the rule once and both sides follow it: the file stores call
cascade() from destroy(), mysql goes on using its constraints.
references.test.js holds whichever store is configured to that one
declaration, and doubles as the repro. Every case seeds a second parent whose
child has to survive, so taking too much fails as loudly as taking too little,
and via builds the fixture, so a wrong field name fails too.

Watch how you check this. mysql reads a session through its user
(session/store/mysql.js joins nt_user on u.deleted=0), so a session that
survived still reads as absent once the user is gone. Each doomed child is
deleted a second time and has to report there was nothing left.

Verified on mysql, json and toml — targeted green, ./test/run.sh green, no
skips or todos. Three negative checks, each run: drop a cascade() call and that
edge fails; drop the soft-deleted pass and nameserver and zone_record fail; save
the parent before cascading and the retry case fails.

Draft until #61 lands: it edits three files #61 rewrites, and #61 adds a fourth
edge. Measured there at e4bd365 — after destroying the group,
Delegation.delete({gid, oid, type}) returns true on json, meaning the row was
still there, and null on mysql. Its delete() takes the whole triple, so the
no-destroy branch in cascade() needs work rather than one more line in the
declaration.