feat(api): advance capability and secure operations slices

apps/api/src/interface/http/instance-routes.ts

@@ -25,6 +25,7 @@ export interface InstanceRoutesOptions {
   readonly connections?: ConnectionProbe;
   readonly login?: InstanceLoginService;
   readonly deletion?: DeleteInstanceOperation;
+  readonly registerDeletionPreparationRoute?: boolean;
 }
 const problem = (
   request: FastifyRequest,
@@ -379,10 +380,12 @@ export function registerInstanceRoutes(app: FastifyInstance, options: InstanceRo
   }
 
   if (options.deletion) {
-    app.post(
-      '/api/v1/operations/prepare',
-      wrap(async (request) => options.deletion!.prepare(request.body as never, request.id)),
-    );
+    if (options.registerDeletionPreparationRoute !== false) {
+      app.post(
+        '/api/v1/operations/prepare',
+        wrap(async (request) => options.deletion!.prepare(request.body as never, request.id)),
+      );
+    }
     app.delete('/api/v1/instances/:instanceId', async (request, reply) => {
       const handled = await wrap(async (wrappedRequest) => {
         const preparationId = wrappedRequest.headers['x-preparation-id'];