Merge pull request 'docs(account): record step 4 (the Android screen) as built' (#395) from docs/account-deletion-android into main

Reviewed-on: #395

android/PLAN.md

@@ -1059,7 +1059,8 @@ push, and Play (M6–M8) follow the designed app.
       [`website/ACCOUNT_DELETION.md`](../website/ACCOUNT_DELETION.md), step 3 below.
    3. **Account deletion** across `website`, the two modules, the kit, this app and
       runicgateway.com (`../website/ACCOUNT_DELETION.md` §6). First, because Play requires it
-      and it takes `MODULE_API` 1.20.0 (org lead, 2026-10-29).
+      and it takes `MODULE_API` 1.20.0 (org lead, 2026-10-29). The app's part, the *Delete my
+      account* screen reached from *My account*, was built 2026-10-30 (that plan's §6 step 4).
    4. **Report, block and hide** across `website`, `Module-Rust`, the kit and this app
       (`USER_SAFETY.md` §7), now `MODULE_API` 1.21.0.
    5. **The cutover**, `edge` → `main`, once 1-4 have landed, so the first Play bundle carries

website/ACCOUNT_DELETION.md

@@ -351,6 +351,23 @@ Asked while building core (§6 step 2), the same day:
      `7bd93b8`.
    - **Not walked:** the live deletions are step 6.
 4. **Android** (`edge`): §4.3. One PR.
+   **Built 2026-10-30.** *Delete my account* is the last thing on *My account*, under a red rule,
+   and opens its own screen with the website's words. Beyond §4.3:
+   - **The refusals are read from the body.** The call reads the raw response, as the
+     trusted-device cap does, so each `code` becomes its own sentence (the web's wording).
+   - **The trust token goes too.** A sign-out keeps it for the next sign-in. A deleted account
+     has no next sign-in, so the token is dropped.
+   - **The notice** is the shell's snackbar, the one the demo's refusals use. The app opens
+     sign-in with Home beneath it.
+   - **Not touched:** the opt-in to push, which belongs to the phone, not the account. It
+     survives, as it does a sign-out.
+
+   Checked on the `s22_ultra` emulator against a local core at `7bd93b8`, with two throwaway
+   players. A wrong password showed "Your password is incorrect." The server logged one 400
+   and no replayed call, so AD12 holds in the app. Each player was deleted, one with an
+   authenticator code. The app opened sign-in with the notice, and back led to a signed-out
+   Home. The demo refusal and the no-password and last-admin refusals are covered by tests
+   only; step 6 walks them.
 5. **runicgateway.com**: §4.5, plus `PLAY_DATA_SAFETY.md` regenerated. One PR.
 6. **A walk**, using a throwaway account on each surface:
    - delete on the website, and in the app on the emulator