feat(account): self-service account deletion, MODULE_API 1.20.0

ACCOUNT_DELETION.md phase 2 (core): a member deletes their own account on
the website, and the admin route runs the same procedure.

- DELETE /api/v1/auth/me/account: typed username, password always (AD7),
  and a 2FA or recovery code when 2FA is on. A wrong password or code is
  400, not 401 (AD12), so the app's refresh-on-401 never replays it.
  409 password_required and last_admin; the demo's shared logins are
  locked.
- auth/accountDeletion.js: module hooks first, then one transaction that
  reserves a staff username (reserved_usernames, AD9) and deletes the row,
  then a Teams reconcile, the audit entry (no username) and a notice to
  the old address (new protected template auth.account-deleted).
- MODULE_API 1.20.0: api.onUserDeleting({ userId, deletedBy }), before the
  delete, 10 s limit, cannot veto (AD10, AD11).
- utils/displayAuthor.js: a deleted account's username snapshots read
  "[deleted player]" to members and the stored name, marked, to staff
  (AD5, AD6). Used by the forum, the Reports queue, the guest list and
  the Team digest. A deleted account drops off Forum guests (AD13).
- Reserved names refuse at every username write, answered as "taken".
- Web: Delete my account on the player and staff Account pages; staff
  views mark "(deleted account)".
- OpenAPI regenerated; route manifest and engagement manifest regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/modules/TeamForumPanel.jsx

@@ -5,6 +5,8 @@ import { api } from '../api/client.js'
 import { useAuth } from '../contexts/AuthContext.jsx'
 import { useSite } from '../contexts/SiteContext.jsx'
 import { REPORT_REASONS, editOfferOpen, stripToText, threadSummary } from '../lib/teamForum.js'
+// A member is sent "[deleted player]"; staff the stored name, which this marks.
+import { markDeleted } from '../lib/deletedAccount.js'
 
 // Core's Team forum, rendered into a second slot a MODULE declares
 // (TEAMS.md Part 5, and the phase 3 amendment to §3.4).
@@ -332,8 +334,7 @@ function ThreadView({ slug, thread, canModerate, imageMode, onBack, onChanged, o
       </h2>
       <p className="sans dim" style={{ fontSize: '0.8rem', margin: '0 0 14px' }}>
         {thread.type === 'announcement' ? 'Announcement · ' : ''}
-        {thread.author}
-        {thread.authorDeleted && ' (account removed)'}
+        {markDeleted(thread.author, thread.authorDeleted)}
         {thread.locked && ' · locked'}
       </p>
 
@@ -448,8 +449,7 @@ function PostView({ slug, post, canModerate, now, onChanged }) {
   return (
     <article style={{ marginBottom: 16 }}>
       <p className="sans dim" style={{ fontSize: '0.78rem', margin: '0 0 2px' }}>
-        {post.author}
-        {post.authorDeleted && ' (account removed)'}
+        {markDeleted(post.author, post.authorDeleted)}
         {post.editedAt && ' · edited'}
         {post.status === 'hidden' && ' · hidden'}
       </p>

client/src/modules/version.js

@@ -11,6 +11,9 @@
 // that the two files can drift, so a test asserts they agree
 // (client/test/moduleRegistry.test.js) rather than trusting a bump to remember
 // both.
+// 1.20.0 — `api.onUserDeleting` (ACCOUNT_DELETION.md §4.1, AD10): a module
+// unlinks a person's game links before their account is deleted. Server-side
+// only. This file bumps for the reason at the top.
 // 1.19.0 — an event action may declare `demoRefuses(params)` (DEMO_MODE.md §3.4,
 // DM18): the demo refuses a step at save. Server-side only; the refusal reaches
 // the browser as an ordinary DEMO_LOCKED answer. This file bumps for the reason at the top.
@@ -105,4 +108,4 @@
 // but the two halves state ONE version: a module declares a single coreApi range
 // and is served one chunk, so a client that claimed 1.0.0 while the server
 // answered 1.1.0 would be two answers to one question.
-export const MODULE_API_VERSION = '1.19.0'
+export const MODULE_API_VERSION = '1.20.0'