Delete Account

Permanently delete the authenticated user and all their data.

Password is re-verified. The Stripe customer is deleted first (which cancels any subscription and removes Stripe-side PII) — if that call fails we abort before touching the local row so a paid subscription is never left orphaned.

This ordering is deliberate: the remaining non-atomic window is between a successful Stripe delete and the DB commit. If the commit then fails, the account survives with its billing already cancelled — recoverable (the user keeps their account and can re-subscribe, with no ongoing charges). The inverse ordering would risk a live subscription charging a deleted account, which is the worse failure, so we accept this direction.

The users row is hard-deleted; FKs cascade to refresh_tokens, api_keys, email_verification_tokens and citation_validation_reports. daily_usage has no FK (keyed by subject_id = user_id, by research_subjects(user_id) for the research chat, or by api_key id for keys without a user_id), so it is cleaned up explicitly.