Delete Account

Delete the caller’s auth user, cascade-clean org + keys.

Order matters: delete the user first. Until that succeeds the account is intact, so a failure leaves the caller recoverable. Once the user is gone they can no longer authenticate, so any orphaned org/keys rows are unreachable.