test: verify document is actually soft-deleted (not hard-deleted) in soft-delete visibility test

Addresses Copilot review feedback on PR #13505: refresh_from_db() and
assert deleted_at is set before checking visibility, so this test
actually validates the deleted_at__isnull=True filtering behavior
rather than just checking the document disappeared from the queryset
for any reason.

src/documents/tests/test_permission_filtering_security.py

@@ -92,6 +92,11 @@ class TestPermittedDocumentIdsSecurity:
         owner = User.objects.create_user(username="owner")
         doc = DocumentFactory(owner=owner)
         doc.delete()  # soft delete
+        doc.refresh_from_db()
+        assert doc.deleted_at is not None, (
+            "document should be soft-deleted, not hard-deleted, for this "
+            "test to actually validate the deleted_at filtering behavior"
+        )
 
         assert_visible_document_ids(
             permitted_document_ids(owner),