feat(account): hold account deletion and data wipe for a grace window

Deleting an account, a guardian deleting a managed profile, and "Delete
all data" were final the moment they were confirmed: the account row
cascaded into every table and every stored copy, and the off-host objects
were purged in the same breath. Nothing short of rolling the whole
instance back could return one account.

ACCOUNT_DELETION_GRACE_DAYS (14 by default, at most 30, 0 erases at once
as before) now sets a window:

- Account and managed-profile deletion lock the account (migration 0488:
  deletion_requested_at, deletion_purge_at, deletion_requested_by_id).
  Every session, refresh token, API token, connector, share link and
  step-up elevation is revoked in the same transaction, and the record,
  its stored copies and its off-host objects are left as they are.
- Sign-in is refused with 403 auth.account.deletion_pending and the
  erasure date, after the credential was proved and before a second
  factor is asked for. The session and Bearer resolvers and the acting-
  account resolver refuse a pending account too, so a credential minted
  in the moment before the lock is useless.
- POST /api/admin/users/{id}/undo-deletion (cookie-only, audit-logged)
  clears the lock. The admin users list reports the pending state.
- The hourly account-deletion-purge job erases accounts whose window has
  ended, exactly as the immediate deletion did, with the off-host purge
  request committed alongside. The Guardian invariant is decided again;
  a refused erasure stays pending and is reported.
- A wipe first stores the whole record as a PRE_WIPE_<ms> copy through
  the writer the weekly copy uses, keeps it out of the wipe, and holds
  its off-host purge back with a new not_before on the request. The
  ordinary restore brings the record back; restoring that copy withdraws
  the held purge. The purge job deletes the copy when its window ends.

Background work skips accounts pending deletion through one shared
predicate (src/lib/account-deletion/active-account.ts): every reminder,
digest, Coach, sync, backfill, rollup, score and backup enumeration
filters with it, and account-deletion-enumeration-guard.test.ts fails on
a query in background work that neither filters nor says why it need
not. Notification delivery and the AI capability loader refuse a pending
account as chokepoints behind it, and the Withings, WHOOP and Telegram
webhooks and the notification quick actions ignore one.

The privacy summary publishes the window. Two pieces of the reminder tick
and the off-host pass moved into modules of their own to keep the files
inside their size ratchet.

src/app/api/admin/users/[id]/undo-deletion/route.ts

@@ -0,0 +1,53 @@
+/**
+ * POST /api/admin/users/[id]/undo-deletion — give back an account pending
+ * deletion.
+ *
+ * Account deletion, and a Guardian's deletion of a managed profile, lock the
+ * account for a grace window before the purge job erases it
+ * (`ACCOUNT_DELETION_GRACE_DAYS`). Until then the record, its stored copies
+ * and its off-host objects are untouched, so undoing it clears the pending
+ * stamp and nothing else: everything the account held is there as it was.
+ * Every credential stays revoked; the person signs in again (a managed
+ * profile is reached through its Guardians, as before).
+ *
+ * Cookie-only (`requireAdmin`), audit-logged for the admin and on the account
+ * itself. Serialised with the purge job on the account row, so an undo either
+ * lands before the erasure or answers 404 after it.
+ */
+import { NextRequest } from "next/server";
+import { apiHandler, requireAdmin } from "@/lib/api-handler";
+import { apiError, apiSuccess, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { cancelAccountDeletion } from "@/lib/account-deletion/lifecycle";
+
+export const dynamic = "force-dynamic";
+
+export const POST = apiHandler(
+  async (
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string }> },
+  ) => {
+    const { user: admin } = await requireAdmin();
+    const { id } = await params;
+    annotate({
+      action: {
+        name: "admin.users.undo-deletion",
+        entity_type: "user",
+        entity_id: id,
+      },
+    });
+
+    const outcome = await cancelAccountDeletion({
+      userId: id,
+      adminId: admin.id,
+      ipAddress: getClientIp(request),
+    });
+    if (outcome === "not_found") return apiError("User not found", 404);
+    if (outcome === "not_pending") {
+      return apiError("This account is not pending deletion", 409, {
+        errorCode: "account.deletion.not_pending",
+      });
+    }
+    return apiSuccess({ restored: true });
+  },
+);

src/app/api/admin/users/__tests__/route.test.ts

@@ -100,6 +100,8 @@ describe("GET /api/admin/users", () => {
       // BigInt in Prisma, plain number on the wire.
       documentQuotaBytes: 2_147_483_648,
       passkeyCount: 2,
+      // Not pending deletion.
+      deletion: null,
     });
     expect(body.data[1].passkeyCount).toBe(0);
     expect(body.data[1].email).toBeNull();
@@ -123,6 +125,9 @@ describe("GET /api/admin/users", () => {
       createdAt: true,
       mfaEnforced: true,
       documentQuotaBytes: true,
+      deletionRequestedAt: true,
+      deletionPurgeAt: true,
+      deletionRequestedById: true,
       _count: { select: { passkeys: true } },
     });
     expect(args.select).not.toHaveProperty("passwordHash");

src/app/api/admin/users/route.ts

@@ -18,6 +18,9 @@ export const GET = apiHandler(async () => {
       createdAt: true,
       mfaEnforced: true,
       documentQuotaBytes: true,
+      deletionRequestedAt: true,
+      deletionPurgeAt: true,
+      deletionRequestedById: true,
       _count: { select: { passkeys: true } },
     },
     orderBy: { createdAt: "asc" },
@@ -39,6 +42,20 @@ export const GET = apiHandler(async () => {
       documentQuotaBytes:
         u.documentQuotaBytes === null ? null : Number(u.documentQuotaBytes),
       passkeyCount: u._count.passkeys,
+      // An account pending deletion: when it was asked for, when the
+      // purge job erases it, and whether the account asked itself or a
+      // Guardian deleted the managed profile. Null on every other account.
+      // The list offers "Undo deletion" on these rows until `purgeAt`.
+      deletion: u.deletionRequestedAt
+        ? {
+            requestedAt: u.deletionRequestedAt,
+            purgeAt: u.deletionPurgeAt,
+            requestedBy:
+              u.deletionRequestedById === u.id
+                ? ("self" as const)
+                : ("guardian" as const),
+          }
+        : null,
     })),
   );
 });