DELETE /v1/users/me — soft-delete the current user (GDPR right-to-be-forgotten).

The user's PII (email, name, password hash, MFA secret, avatar) is cleared and the row is tombstoned with deleted_at. Sessions are invalidated, org memberships removed, and pending invites issued by this user revoked. Audit events are preserved.

Requires fresh credential proof: the current password (password-backed accounts) or a TOTP code (MFA-enabled accounts). At least one must be supplied; both being valid is fine but a single matching proof is enough.

Returns 409 Conflict if the user is the sole owner of an organization — ownership must be transferred first.