Data deletion

Data-deletion instructions are not approved for launch. Exact retention and deletion policy must be published by the owner before production validation can pass.

An authenticated user can request account deletion after recent-auth confirmation and explicit DELETE confirmation. The request changes the account to deletion_pending, revokes its sessions, prevents new jobs, and queues owned media for asynchronous cleanup. Deletion is not complete while cleanup remains pending.