fix security

VigilCareClinicalAPI/Controllers/AlertThresholdsController.cs

@@ -73,4 +73,19 @@ public class AlertThresholdsController : ControllerBase
         var threshold = await _thresholds.UpdateAsync(id, req);
         return Ok(ApiResponse<AlertThreshold>.Ok(threshold));
     }
+
+    /// <summary>
+    /// Deletes an alert threshold. Clinical entities (patients, encounters, observations,
+    /// alerts, scores) are immutable by design and do not support deletion.
+    /// </summary>
+    /// <param name="id">Threshold id.</param>
+    [HttpDelete("{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.ThresholdsWrite)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Delete(Guid id)
+    {
+        await _thresholds.DeleteAsync(id);
+        return NoContent();
+    }
 }