feat: account deletion (barrier, teardown, tombstones) + subscription reclaim

.env.example

@@ -146,6 +146,27 @@ SIWE_ALLOWED_CHAIN_IDS=1
 # Generate with: openssl rand -hex 32
 # Treat as a secret; rotate via deploy if compromised (invalidates in-flight nonces, 5-min TTL absorbs).
 NONCE_HMAC_SECRET=
+# REQUIRED — HMAC secret keying account-deletion barrier hashes and pseudonymous
+# deletion-record refs. Must be >= 64 hex chars (32 bytes).
+# Generate with: openssl rand -hex 32
+# PERMANENT: never rotate — rotation orphans every DeletedIdentity barrier row
+# (silently lifting the deletion bar) and breaks deletion-record lookups.
+DELETION_HASH_SECRET=
+# Rollout gate for DELETE /v2/accounts/me — fail-closed, only the exact
+# string "true" enables it (flip = infra PR + task-definition roll).
+ACCOUNT_DELETION_ENABLED=false
+# OPTIONAL — PostHog person deletion for account-deletion purges. The
+# ingestion token cannot delete persons; these enable the private-API call.
+# When analytics is active but these are unset, posthog purge tasks fail and
+# retry (paging ops) instead of silently skipping.
+POSTHOG_PERSONAL_API_KEY=
+POSTHOG_PROJECT_ID=
+POSTHOG_API_HOST=
+
+# --- Subscription restoration ---
+# Claims of deleted accounts' Apple subscriptions.
+SUBSCRIPTION_CLAIM_TOMBSTONE_ENABLED=true
+# Live ownership transfers and Google claim proof are deferred to a follow-up.
 
 # --- Payments / Credits ---
 # REQUIRED — All five PAYMENTS_* knobs below are hard-required. Backend

prisma/migrations/20260715094310_add_account_deletion/migration.sql

@@ -0,0 +1,80 @@
+-- Account deletion: barrier, deletion record, purge outbox, billing
+-- tombstones, and the lastAuthAt activity stamp. Purely additive.
+
+-- AlterTable
+ALTER TABLE "Account" ADD COLUMN     "lastAuthAt" TIMESTAMP(3);
+
+-- CreateTable
+CREATE TABLE "DeletedIdentity" (
+    "identityHash" TEXT NOT NULL,
+    "deletedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "DeletedIdentity_pkey" PRIMARY KEY ("identityHash")
+);
+
+-- CreateTable
+CREATE TABLE "DeletionRecord" (
+    "operationId" UUID NOT NULL,
+    "accountRef" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'purging',
+    "requestedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "completedAt" TIMESTAMP(3),
+    "expiresAt" TIMESTAMP(3),
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "DeletionRecord_pkey" PRIMARY KEY ("operationId")
+);
+
+-- CreateTable
+CREATE TABLE "DeletionTask" (
+    "id" UUID NOT NULL DEFAULT gen_random_uuid(),
+    "operationId" UUID NOT NULL,
+    "kind" TEXT NOT NULL,
+    "payload" JSONB NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "nextAttemptAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastError" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "completedAt" TIMESTAMP(3),
+
+    CONSTRAINT "DeletionTask_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SubscriptionTombstone" (
+    "id" UUID NOT NULL DEFAULT gen_random_uuid(),
+    "provider" "BillingProvider" NOT NULL,
+    "providerKey" TEXT NOT NULL,
+    "accountRef" TEXT NOT NULL,
+    "deletedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "SubscriptionTombstone_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "DeletionRecord_accountRef_idx" ON "DeletionRecord"("accountRef");
+
+-- CreateIndex
+CREATE INDEX "DeletionRecord_status_requestedAt_idx" ON "DeletionRecord"("status", "requestedAt");
+
+-- CreateIndex
+CREATE INDEX "DeletionRecord_expiresAt_idx" ON "DeletionRecord"("expiresAt");
+
+-- CreateIndex
+CREATE INDEX "DeletionTask_status_nextAttemptAt_idx" ON "DeletionTask"("status", "nextAttemptAt");
+
+-- CreateIndex
+CREATE INDEX "DeletionTask_operationId_idx" ON "DeletionTask"("operationId");
+
+-- CreateIndex
+CREATE INDEX "SubscriptionTombstone_accountRef_idx" ON "SubscriptionTombstone"("accountRef");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SubscriptionTombstone_provider_providerKey_key" ON "SubscriptionTombstone"("provider", "providerKey");
+
+-- Backfill: existing accounts start their activity clock at migration time.
+-- A null lastAuthAt must never read as "inactive/no veto"; after this
+-- backfill, null only ever means a brand-new account that has not minted yet.
+UPDATE "Account" SET "lastAuthAt" = CURRENT_TIMESTAMP WHERE "lastAuthAt" IS NULL;