docs(kit): pin core 1.20.0; teach onUserDeleting

Moves ci/core-ref.json from 69998ec (1.19.0) to 7bd93b8 (1.20.0, website#232,
account deletion). Chapter 2 gains "When a member deletes their account": the
hook runs before the row goes, a cascade is not an unlink, it cannot stop the
deletion, so a module that talks to a game needs a record and a retry. Its call
count becomes twenty-one. The demo section now says core refuses multipart bodies
and data: URIs (website#229) on module routes without them being listed. The
template's coreApi becomes ^1.20.0 for the equality check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

template/module.json

@@ -2,7 +2,7 @@
   "id": "examplegame",
   "name": "Example Game",
   "version": "0.1.0",
-  "coreApi": "^1.19.0",
+  "coreApi": "^1.20.0",
   "server": "server/index.js",
   "client": { "entry": "client/dist/entry.js" },
   "schema": "server/db/schema.sql",