Hard-delete the caller's OWN account and everything they own, reusing the SAME single-transaction cascade the admin surface uses (db.admin_delete_user — FK-safe order, per-table counts, sessions included so every device is logged out by construction).

Confirmation is deliberate friction: the TYPED email must match (400) and the password must verify with login's bcrypt + timing discipline (403). Admins and audit-authoring users are refused (400) — the append-only audit log must never lose its author row (see db.user_authored_admin_audit).