feat(admin): deleted-account dossier + operator delete-user action

The user-detail console gains a Deletion & retention panel: last login (time + IP),
the tombstone (deleted-at + retained real name), and the retention journal (the legal
dossier of detached credentials). A Delete-user action runs the same deletion
orchestration as the in-app flow (mirrors the email-erase pattern). Store readers
RetainedIdentities + DeletionInfo back the view; integration test covers them.

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -107,6 +107,24 @@
 </form>
 {{end}}
 </section>
+<section class="panel"><h2>Deletion &amp; retention</h2>
+{{if .LastLoginAt}}<p class="note">Last login: {{.LastLoginAt}}{{if .LastLoginIP}} — <code>{{.LastLoginIP}}</code>{{end}}</p>{{end}}
+{{if .Deleted}}<p><span class="warn">Deleted</span> at {{.DeletedAt}}{{if .DeletedName}} — was <code>{{.DeletedName}}</code>{{end}}</p>{{end}}
+{{if .Retained}}
+<h3>Retention journal (legal dossier of detached credentials)</h3>
+<table class="list">
+<thead><tr><th>Kind</th><th>Credential</th><th>Reason</th><th>Detached</th></tr></thead>
+<tbody>
+{{range .Retained}}<tr><td>{{.Kind}}</td><td><code>{{.ExternalID}}</code></td><td>{{.Reason}}</td><td>{{.DetachedAt}}</td></tr>{{end}}
+</tbody>
+</table>
+{{end}}
+{{if not .Deleted}}{{if not .Guest}}
+<form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
+<button type="submit">Delete user</button>
+</form>
+{{end}}{{end}}
+</section>
 <section class="panel"><h2>Friends</h2>
 <table class="list">
 <thead><tr><th>Account</th><th>Friends since</th></tr></thead>