deletion: maintain per-account file manifest, cancel leases upon removal

[warner]

At some point, we need to implement deletion. I think that each node should be responsible for keeping track of a manifest of all the files that they care about (i.e. everything that is reachable from their roots), and when a file falls off this list, they should cancel the leases associated with it.

See also #119.