Delete the signed-in user's own account

Runs user.deleteMyAccount. IRREVERSIBLE. Anonymizes the Better Auth user row (name/email/image blanked to deleted-<id>@anon.local) and BANS it so sign-in is impossible, hard-deletes the owned personal-data tables (profile, addresses, saved payment methods, travel companions, recently viewed, saved searches, price alerts and watches, notification preferences, notifications, wishlists), revokes every active session, then writes a gdpr_request deletion record and a user.self_deleted audit entry. Bookings, reviews, support tickets and the audit log are deliberately KEPT for legal and accounting retention — they now point at the anonymized row. Requires { "confirm": "DELETE MY ACCOUNT" } verbatim; anything else is a 400. Refuses non-customer roles with 403 FORBIDDEN — staff and admin accounts go through admin offboarding so access can be handed over first.