feat(account): journal detached credentials to the retention log

On unlink (RemoveIdentity, reason=unlink) and email change (replaceEmailIdentity,
reason=change) write the outgoing credential to retained_identities before removing
the live identities row — so the legal dossier survives while the (kind, external_id)
frees for reuse. Same transaction, so the dossier and live state cannot diverge.
Integration tests cover both reasons.

backend/internal/account/email.go

@@ -546,6 +546,25 @@ func (s *Store) replaceEmailIdentity(ctx context.Context, confirmationID, accoun
 		if _, err := upd.ExecContext(ctx, tx); err != nil {
 			return fmt.Errorf("consume confirmation: %w", err)
 		}
+		// Journal the outgoing email before replacing it, so the legal dossier keeps the
+		// address the account used to hold (see retention.go).
+		var old model.Identities
+		sel := postgres.SELECT(
+			table.Identities.ExternalID, table.Identities.Confirmed, table.Identities.CreatedAt,
+		).FROM(table.Identities).WHERE(
+			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
+				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
+		).LIMIT(1)
+		switch err := sel.QueryContext(ctx, tx, &old); {
+		case err == nil:
+			if err := retainIdentityTx(ctx, tx, accountID, KindEmail, old.ExternalID, old.Confirmed, old.CreatedAt, retainChange); err != nil {
+				return err
+			}
+		case errors.Is(err, qrm.ErrNoRows):
+			// No prior email (this doubles as an attach); nothing to retain.
+		default:
+			return fmt.Errorf("load outgoing email identity: %w", err)
+		}
 		del := table.Identities.DELETE().WHERE(
 			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
 				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),

backend/internal/account/link.go

@@ -31,21 +31,29 @@ func (s *Store) RemoveIdentity(ctx context.Context, accountID uuid.UUID, kind st
 	if err != nil {
 		return err
 	}
-	hasKind, others := false, 0
+	var toRetain []Identity
+	others := 0
 	for _, id := range ids {
 		if id.Kind == kind {
-			hasKind = true
+			toRetain = append(toRetain, id)
 		} else {
 			others++
 		}
 	}
-	if !hasKind {
+	if len(toRetain) == 0 {
 		return ErrNotFound
 	}
 	if others == 0 {
 		return ErrLastIdentity
 	}
 	return withTx(ctx, s.db, func(tx *sql.Tx) error {
+		// Journal the detached credential before removing it, so the legal dossier
+		// survives while the identity frees for reuse (see retention.go).
+		for _, id := range toRetain {
+			if err := retainIdentityTx(ctx, tx, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainUnlink); err != nil {
+				return err
+			}
+		}
 		delID := table.Identities.DELETE().WHERE(
 			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
 				AND(table.Identities.Kind.EQ(postgres.String(kind))),

backend/internal/account/retention.go

@@ -0,0 +1,43 @@
+package account
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/postgres/jet/backend/table"
+)
+
+// Reasons recorded on a retained_identities row: what detached the credential from its
+// account. The row is written just before the live identities row is removed, preserving
+// the legal dossier (which email/vk/tg was linked, and when) even as the identity frees
+// for reuse. See docs/ARCHITECTURE.md §9.1.
+const (
+	retainUnlink = "unlink"
+	retainChange = "change"
+	retainDelete = "delete"
+)
+
+// retainIdentityTx appends a retention-journal row for one identity being detached, inside
+// tx. linkedAt is the identity's original creation time; detached_at defaults to now(). It
+// must run in the same transaction as the identity removal, so the dossier and the live
+// state can never diverge.
+func retainIdentityTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind, externalID string, confirmed bool, linkedAt time.Time, reason string) error {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return fmt.Errorf("account: new retained id: %w", err)
+	}
+	ins := table.RetainedIdentities.INSERT(
+		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
+		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
+		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
+		table.RetainedIdentities.Reason,
+	).VALUES(id, accountID, kind, externalID, confirmed, linkedAt, reason)
+	if _, err := ins.ExecContext(ctx, tx); err != nil {
+		return fmt.Errorf("account: retain identity (%s, %s): %w", kind, externalID, err)
+	}
+	return nil
+}