feat(account): deletion orchestration + step-up + gateway edge

Step-up: email accounts confirm with a mailed code (purpose=delete, no deeplink —
ConfirmByToken refuses a delete token so a stray click can't delete); platform-only
accounts type a fixed phrase (anti-impulse). Endpoints /user/delete/{request,confirm};
the confirm orchestration resigns active games, drops all-robot games, tombstones +
anonymizes the account (freeing its creds), and revokes its sessions — the tombstone is
the point of no return, the rest best-effort. Gateway account.delete.{request,confirm}
ops + fbs AccountDeleteConfirm/AccountDeleteRequestResult + branded ru/en delete email.
Integration tests cover the step-up (code + no-email) and the orchestration pieces.

backend/internal/account/emailtemplate.go

@@ -98,6 +98,24 @@ var confirmEmailCopy = map[string]map[string]emailCopy{
 			FooterIgnore: "Если вы не запрашивали смену, просто проигнорируйте письмо — адрес останется прежним.",
 		},
 	},
+	purposeDelete: {
+		"en": {
+			Subject:      "Confirm your Erudit account deletion",
+			Preheader:    "Confirm account deletion",
+			Heading:      "Delete your account",
+			Intro:        "Enter this code in the app to permanently delete your account:",
+			CTALabel:     "",
+			FooterIgnore: "If you didn't request this, ignore it — your account stays as it is.",
+		},
+		"ru": {
+			Subject:      "Подтвердите удаление аккаунта Эрудит",
+			Preheader:    "Подтверждение удаления аккаунта",
+			Heading:      "Удаление аккаунта",
+			Intro:        "Введите этот код в приложении, чтобы удалить аккаунт без восстановления:",
+			CTALabel:     "",
+			FooterIgnore: "Если вы не запрашивали удаление, проигнорируйте письмо — аккаунт останется.",
+		},
+	},
 }
 
 // emailBrand is the brand wordmark per locale.