Delete the calling account (GDPR erasure); confirmEmail must match

Requires the authenticated web session; every Bearer token, including admin scope, receives 403 FORBIDDEN (Account deletion requires the web session). Irreversible. Refused with 409 while the caller is the only owner of a workspace that still has other members — transfer ownership or delete those workspaces first. A second, rarer 409 (Workspace memberships changed while deleting — try again) means a workspace membership changed while the deletion ran: no account or workspace was deleted, and the same call can be sent again. Sole-member workspaces are deleted along with the account. confirmEmail must be sent as a JSON body.