Delete Own Account

Self-serve full account deletion (WA MHMDA / CA CMIA deletion right).

Hard-deletes the calling user's account: SuperTokens credentials, every user_id-bearing row in _USER_DEPENDENT_TABLES (including spiritus_consents), and the app user row. Purge is immediate — well inside the 30-day SLA the privacy policy promises (WA MHMDA allows 45 days).

Requires body.confirm to exactly match the account email so a stray client call can't wipe an account. The session is revoked as part of deletion, so the caller is logged out everywhere when this returns.