Use paranoia for deleted_at functionality

Fixes #3321
No need to call accessible_by again in ProductsController, as it is already done in BaseController's product_scope
[backend] Correct typo in products_controller_spec