docs(website): plan self-service account deletion

ACCOUNT_DELETION.md is the plan of record for the org lead's decision:
a member deletes their own account on the website and in the app, as
Google Play requires of an app that starts accounts.

- One deletion service for the admin route and the member's own route,
  with a confirm step, the last-admin and demo refusals, clearing the
  username snapshots on what the member wrote, and a notice by email.
- MODULE_API 1.20.0: api.onUserDeleted, which runs after the commit and
  can't stop a deletion.
- Screens on the web and in the app; runicgateway.com /delete-account/
  as the address Play is given.
- What the schema already does (59 keys: credentials cascade, content
  detaches), the gaps, six questions, and the build order.

M8's order puts account deletion before report, block and hide, which
moves USER_SAFETY.md's reportTargets to MODULE_API 1.21.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

android/PLAN.md

@@ -1055,11 +1055,14 @@ push, and Play (M6–M8) follow the designed app.
       game-account creation), so Play requires a deletion path in the app and at a web address,
       and the platform had none: only an admin could delete an account. A member gets *Delete
       my account* on the website and in the app, which removes the account and its game links.
-      A runicgateway.com page explains it, and that page's address is the one Play is given. It
-      is planned as its own piece of work, before the cutover.
-   3. **Report, block and hide** across `website`, `Module-Rust`, the kit and this app
-      (`USER_SAFETY.md` §7).
-   4. **The cutover**, `edge` → `main`, once 1-3 have landed, so the first Play bundle carries
+      A runicgateway.com page explains it, and that page's address is the one Play is given. The plan is
+      [`website/ACCOUNT_DELETION.md`](../website/ACCOUNT_DELETION.md), step 3 below.
+   3. **Account deletion** across `website`, the two modules, the kit, this app and
+      runicgateway.com (`../website/ACCOUNT_DELETION.md` §6). First, because Play requires it
+      and it takes `MODULE_API` 1.20.0 (org lead, 2026-10-29).
+   4. **Report, block and hide** across `website`, `Module-Rust`, the kit and this app
+      (`USER_SAFETY.md` §7), now `MODULE_API` 1.21.0.
+   5. **The cutover**, `edge` → `main`, once 1-4 have landed, so the first Play bundle carries
       all of it. **Before it merges, the org lead enrolls the existing keystore as the app-signing
       key** in Play Console (App integrity, "use my own key"). `PLAY_SERVICE_ACCOUNT_JSON` is
       already set, so the release run will call Play, and the signing choice is permanent. On the