Delete every row and file this engine holds for the authenticated tenant.

Guarded by get_current_user: SaaS ON ⇒ 401 without a valid entitlement token, and the tenant purged is the token's own sub — a caller can never name someone else's id, which is why this route takes no body and no path parameter.

SaaS OFF (desktop / self-host) there is no tenant to purge — every row belongs to the NULL owner — so the route answers 404 rather than offering a factory reset over HTTP.

A purge that does not fully drain the tenant answers 500 carrying its own report. That is deliberate: the platform's deleteAccount turns a non-2xx here into a Sentry issue tagged kind:account-deletion-residue on the SAME trace id (the storefront stamps sentry-trace on this call), instead of logging a success line over a tenant that is still full.