docs(website): plan self-service account deletion

ACCOUNT_DELETION.md is the plan of record for the org lead's decision:
a member deletes their own account on the website and in the app, as
Google Play requires of an app that starts accounts.

- One deletion service for the admin route and the member's own route,
  with a confirm step, the last-admin and demo refusals, clearing the
  username snapshots on what the member wrote, and a notice by email.
- MODULE_API 1.20.0: api.onUserDeleted, which runs after the commit and
  can't stop a deletion.
- Screens on the web and in the app; runicgateway.com /delete-account/
  as the address Play is given.
- What the schema already does (59 keys: credentials cascade, content
  detaches), the gaps, six questions, and the build order.

M8's order puts account deletion before report, block and hide, which
moves USER_SAFETY.md's reportTargets to MODULE_API 1.21.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/USER_SAFETY.md

@@ -1,7 +1,8 @@
 # Report, block and hide — user safety on the website and in the app
 
 **Status:** plan of record, 2026-10-29. Nothing built yet. Each phase stops for the org lead
-before the next one starts.
+before the next one starts. Built after account deletion ([`ACCOUNT_DELETION.md`](ACCOUNT_DELETION.md)),
+which is why it is `MODULE_API` 1.21.0.
 
 **Why now.** Google Play's content-rating questionnaire for the Android app (`android/PLAN.md` M8)
 was answered "users or user-generated content can be reported". The app shows other players' chat
@@ -56,7 +57,7 @@ staff's.
   a module's content can be reported as (for Rust: `rust.chat`). Each type answers two questions for
   core: `snapshot(id)` (author, text, time, where it was said), and `hide(id, actor)` /
   `unhide(id, actor)`. Core files the report, stores the snapshot and runs the queue. The module owns
-  the content and its hidden flag. This is a `MODULE_API` minor bump, **1.20.0**. The Integration
+  the content and its hidden flag. This is a `MODULE_API` minor bump, **1.21.0**. The Integration
   Kit re-pins and gains a paragraph.
 - **One filing route for every target**: `POST /player/reports {targetType, targetId, reason,
   detail?}`. Forum types keep working through the existing forum route, which then calls the same
@@ -119,7 +120,7 @@ Play declarations gain "user-generated content: collected". M21 says so.
 ## 7. Build order
 
 1. **This plan** (docs), with §5's answers.
-2. **Core** (`website`): §4.1, `MODULE_API` 1.20.0, tests, OpenAPI, `BACKEND_DESIGN.md`,
+2. **Core** (`website`): §4.1, `MODULE_API` 1.21.0, tests, OpenAPI, `BACKEND_DESIGN.md`,
    `MODULE_API.md`, `TEAMS.md` §5.6 amended. One PR.
 3. **Module-Rust** (`edge`): §4.2 plus the core-ref pin. One PR. **Integration-kit**: the re-pin and
    a paragraph on `reportTargets`. One PR.