The delete button reads the form's target URL from form.action in JavaScript - but the form also has a hidden field named action (carrying the server-side action=delete value), and a form field's name shadows a same-named property on the <form> element. So form.action was returning that hidden input instead of the URL, and the delete request went to a nonsense address instead of the server - it never reached the app at all, which is also why nothing showed up in the server logs while this was happening.
The button now reads the URL from the form's action attribute directly instead of the shadowed property, so delete requests go where they're supposed to.