=true for types that store files (media, textFile). No cascade for layout/category.
Important notes

Permissions: Deleting via the API requires a Sanity token with write permissions. Your server-side client currently reads from SANITY_API_READ_TOKEN. If this token is read-only, API deletes will fail. If needed, set a token with write scope (e.g., SANITY_API_TOKEN) and I can wire the client to use it on the server.
In-Studio delete: The red “Danger zone” Delete button inside Studio forms deletes the document