feat(account): hide deleted accounts and clean up their rows

Auth marks a deleted user in deleted_user (no sync, not in landing stats or pile snapshots) and later purges the rows through /internal/accounts with a service token. Prune removes rows of user ids Auth does not know. Dry run by default.

src/main/resources/application.yml

@@ -70,6 +70,11 @@ app:
     image-repair-batch: 200
     image-repair-max-attempts: 3
     image-repair-retry-days: 30
+  account-cleanup:
+    # Log only, delete nothing. Auth's nightly cleanup drives this; see the Deployment README before flipping it.
+    dry-run: ${APP_ACCOUNT_CLEANUP_DRY_RUN:true}
+    # A prune refuses more orphans than this per run; raise it once for a big cleanup.
+    max-orphans: 5
 
 resilience4j:
   retry:

src/main/resources/db/migration/V19__deleted_user.sql

@@ -0,0 +1,6 @@
+-- Users Auth has flagged as deleted. Core hides them at once: no sync, not in the landing stats or the pile
+-- snapshots. The nightly cleanup of Auth removes the row together with all rows of the user.
+CREATE TABLE deleted_user (
+    user_id    BIGINT      PRIMARY KEY,
+    deleted_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);