Rescind a pending account deletion inside the 30-day window (R-RESCIND, OWNER 2026-09-25).

Order, and why:

1. pg_clear_user_deletion_requested -- the window is the UPDATE's own predicate; 0 rows means nothing was pending or the window closed (409: the row now belongs to the purge cron). A write failure propagates (500), never reads as "0 rows".
2. rescind_subscriptions_for_erasure -- lift the period-end cancel the deletion set (marker ol_deletion_requested) on every subscription still at Stripe (best-effort, never raises; a subscription the period end already closed is gone, a cancel the person or the refund path set is kept, neither is an error). Stripe AFTER the store so a retryable Stripe failure cannot leave the account pending while the person believes it is restored.
3. _audit_log(user, "deletion_rescinded") -- the billing audit trail gets the rescind next to cancellation.py's cancel_requested / cancel_reversed rows. Non-fatal, loud.