feat(account): tell Core about Steam ID and block changes

Sent on the task executor after the commit, and every user again in the nightly cleanup. A failed call only warns.

readme.md

@@ -221,6 +221,7 @@ sequenceDiagram
     Note over A: an old access token gets 401 within 30 s (activeUsers cache)
     Note over A,C: nightly 04:15
     A->>C: PUT /internal/accounts/deleted (all flagged users)
+    A->>C: PUT /internal/accounts/states (every user)
     A->>C: POST /internal/accounts/purge (flagged 30+ days)
     A->>A: DELETE users (only when Core answered and no dry run)
     A->>C: POST /internal/accounts/prune (all user ids)
@@ -229,6 +230,24 @@ sequenceDiagram
 A failed call to Core does not fail the delete: the next night sends the whole flagged set again. Undo within 30
 days is `UPDATE users SET deleted_at = NULL` (see the Deployment README).
 
+### Steam ID and block sync to Core
+
+Core keeps its own copy of the Steam ID and of the block. After a verified Steam link (also for the account that
+loses a typed-in ID), an unlink, a block and an unblock, Auth sends the user's state after the commit
+(`AccountStatePublisher`); the nightly cleanup sends every user. The call runs on the task executor, so neither the answer
+nor a database connection waits for Core; a failed call only warns.
+
+```mermaid
+sequenceDiagram
+    participant A as Auth
+    participant C as Core
+    A->>A: link / unlink / block / unblock (commit)
+    A->>C: POST /internal/accounts/states {userId, steamId, blocked}
+    C->>C: blocked_user, Steam ID in user_steam_sync
+    Note over A,C: nightly 04:15
+    A->>C: PUT /internal/accounts/states (every user)
+```
+
 ## Run locally
 
 ### Local development without keys (profile `local`)