feat(account): self-service account deletion, MODULE_API 1.20.0

ACCOUNT_DELETION.md phase 2 (core): a member deletes their own account on
the website, and the admin route runs the same procedure.

- DELETE /api/v1/auth/me/account: typed username, password always (AD7),
  and a 2FA or recovery code when 2FA is on. A wrong password or code is
  400, not 401 (AD12), so the app's refresh-on-401 never replays it.
  409 password_required and last_admin; the demo's shared logins are
  locked.
- auth/accountDeletion.js: module hooks first, then one transaction that
  reserves a staff username (reserved_usernames, AD9) and deletes the row,
  then a Teams reconcile, the audit entry (no username) and a notice to
  the old address (new protected template auth.account-deleted).
- MODULE_API 1.20.0: api.onUserDeleting({ userId, deletedBy }), before the
  delete, 10 s limit, cannot veto (AD10, AD11).
- utils/displayAuthor.js: a deleted account's username snapshots read
  "[deleted player]" to members and the stored name, marked, to staff
  (AD5, AD6). Used by the forum, the Reports queue, the guest list and
  the Team digest. A deleted account drops off Forum guests (AD13).
- Reserved names refuse at every username write, answered as "taken".
- Web: Delete my account on the player and staff Account pages; staff
  views mark "(deleted account)".
- OpenAPI regenerated; route manifest and engagement manifest regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/model/teams/teamGrants.model.js

@@ -26,6 +26,7 @@ const teamsDb = require('./teams.db')
 const access = require('./teamAccess.model')
 const usersDb = require('../users/users.db')
 const settingsDb = require('../settings/settings.db')
+const { displayAuthor } = require('../../utils/displayAuthor')
 
 // The per-Team ceiling on ACTIVE leader-issued grants. A leader admitting
 // unlimited arbitrary accounts to a private space on the operator's host is a
@@ -136,19 +137,25 @@ async function revoke({ team, actor, userId, reason }) {
  * The subtraction is the §3.2 "Forum guests" list: someone who is both a member
  * and a grantee is a member, listed on the roster, and appears here not at all.
  * Both facts stay true in the ledger; only the presentation picks one.
+ *
+ * **A grant whose account was deleted is not listed** (ACCOUNT_DELETION.md AD13).
+ * Deleting an account clears `user_id` and leaves the row, so the grant would
+ * otherwise sit here as a guest nobody can be: a grant is checked by user id, and
+ * there is no id left to match it. The staff grant ledger still shows it, with the
+ * name. Who GRANTED it follows displayAuthor's rule for `viewer`.
  */
-async function forumGuests(teamId) {
+async function forumGuests(teamId, viewer = null) {
   const [grants, members] = await Promise.all([
     accessDb.activeGrants(teamId),
     teamsDb.membersByTeam(teamId, { includeDeparted: false }),
   ])
   const memberUserIds = new Set(members.map((m) => m.user_id).filter((id) => id != null))
   return grants
-    .filter((g) => g.user_id == null || !memberUserIds.has(g.user_id))
+    .filter((g) => g.user_id != null && !memberUserIds.has(g.user_id))
     .map((g) => ({
       userId: g.user_id,
       username: g.username,
-      grantedBy: g.granted_username,
+      grantedBy: displayAuthor({ userId: g.granted_by, username: g.granted_username }, viewer).name,
       grantedAt: g.granted_at,
       reason: g.reason,
     }))