Self-service account deletion (cooling-off).

Re-authenticates the caller, then flags the row with a deletion timestamp. The account is immediately treated as logged-out (see current_user), but NO data is removed yet — a successful re-login within ACCOUNT_DELETION_GRACE_DAYS clears the flag (undo). A daily sweep (_purge_due_deletions) hard-deletes rows past the window; the Postgres FK CASCADE then removes all owned data, and the sweep also clears OTP codes and decrements blob ref-counts.

Re-auth path is decided by the account type:

• has a real password → must supply the correct password.
• phone/email-OTP-only → must supply a fresh code (requested via the existing /api/auth/sms|email/send), verified against the same OTP table login uses.