GDPR erasure — the profile's Danger-zone button.

Purges every record this account owns and deletes the Firebase user, in that ORDER: identity dies first (a live credential over purged rows could mint a fresh trial the moment anything re-reads it), then our stores. A store failure after identity death is residual DATA — privacy debt, logged and listed in the response — never a live credential over a wiped table.

An active subscription refuses (409): fiscal records are retained 10 years by Italian law, so the subscription must be cancelled first. An UNVERIFIABLE billing state refuses too (503, retryable): the guard will not delete a fiscal record it could not check for a live subscription.

No email_verified check, on purpose: an unconfirmed account must always be able to erase itself.