feat(admin): deleted-account dossier + operator delete-user action

The user-detail console gains a Deletion & retention panel: last login (time + IP),
the tombstone (deleted-at + retained real name), and the retention journal (the legal
dossier of detached credentials). A Delete-user action runs the same deletion
orchestration as the in-app flow (mirrors the email-erase pattern). Store readers
RetainedIdentities + DeletionInfo back the view; integration test covers them.

backend/internal/account/retention.go

@@ -3,13 +3,16 @@ package account
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"time"
 
 	"github.com/go-jet/jet/v2/postgres"
+	"github.com/go-jet/jet/v2/qrm"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
 
+	"scrabble/backend/internal/postgres/jet/backend/model"
 	"scrabble/backend/internal/postgres/jet/backend/table"
 )
 
@@ -110,6 +113,71 @@ func (s *Store) ReapExpiredRetention(ctx context.Context, cutoff time.Time) (ide
 	return identities, feedback, nil
 }
 
+// RetainedIdentity is one row of the retention journal, for the admin dossier.
+type RetainedIdentity struct {
+	Kind       string
+	ExternalID string
+	Reason     string
+	Confirmed  bool
+	LinkedAt   time.Time
+	DetachedAt time.Time
+}
+
+// RetainedIdentities returns the account's retention-journal rows (the legal dossier of
+// detached credentials), newest detach first, for the admin console.
+func (s *Store) RetainedIdentities(ctx context.Context, accountID uuid.UUID) ([]RetainedIdentity, error) {
+	var rows []model.RetainedIdentities
+	err := postgres.SELECT(table.RetainedIdentities.AllColumns).
+		FROM(table.RetainedIdentities).
+		WHERE(table.RetainedIdentities.AccountID.EQ(postgres.UUID(accountID))).
+		ORDER_BY(table.RetainedIdentities.DetachedAt.DESC()).
+		QueryContext(ctx, s.db, &rows)
+	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
+		return nil, fmt.Errorf("account: retained identities %s: %w", accountID, err)
+	}
+	out := make([]RetainedIdentity, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, RetainedIdentity{
+			Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
+			Confirmed: r.Confirmed, LinkedAt: r.LinkedAt, DetachedAt: r.DetachedAt,
+		})
+	}
+	return out, nil
+}
+
+// DeletionInfo is a tombstoned account's dossier header, for the admin console.
+type DeletionInfo struct {
+	DeletedAt          *time.Time
+	DeletedDisplayName string
+	LastLoginAt        *time.Time
+	LastLoginIP        string
+}
+
+// DeletionInfo reads the account's deletion tombstone + last-login dossier fields.
+func (s *Store) DeletionInfo(ctx context.Context, accountID uuid.UUID) (DeletionInfo, error) {
+	var row model.Accounts
+	err := postgres.SELECT(
+		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
+		table.Accounts.LastLoginAt, table.Accounts.LastLoginIP,
+	).FROM(table.Accounts).
+		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID))).
+		QueryContext(ctx, s.db, &row)
+	if err != nil {
+		if errors.Is(err, qrm.ErrNoRows) {
+			return DeletionInfo{}, ErrNotFound
+		}
+		return DeletionInfo{}, fmt.Errorf("account: deletion info %s: %w", accountID, err)
+	}
+	info := DeletionInfo{DeletedAt: row.DeletedAt, LastLoginAt: row.LastLoginAt}
+	if row.DeletedDisplayName != nil {
+		info.DeletedDisplayName = *row.DeletedDisplayName
+	}
+	if row.LastLoginIP != nil {
+		info.LastLoginIP = *row.LastLoginIP
+	}
+	return info, nil
+}
+
 // RetentionReaper periodically purges expired account-deletion retention data via
 // Store.ReapExpiredRetention, mirroring GuestReaper: one background goroutine started once
 // from main.