Request deletion of the current user's account

Records a deletion request against the account and revokes every active session, so the caller is signed out on all devices. Signing in again within the 7 day cancellation window clears the request. Idempotent — repeating the call does not move the requested-at timestamp. Erasure of the underlying data is performed separately.