Permanently delete the signed-in account (App Store 5.1.1(v)).

Requires the current password — possession of a bearer credential alone (JWT or API key) must never be enough to destroy an account. Wrong password returns 400, not 401, per the dashboard's 401-means-logout convention; the extra {"confirm": "DELETE"} field stops one-click programmatic accidents.

Fail-closed on billing: any active Stripe subscription is cancelled at Stripe FIRST; if that call fails the account stays intact (503) rather than deleted-but-still-billing. What is scrubbed vs retained is defined in account_lifecycle.scrub_user_updates.