feat(account): deletion orchestration + step-up + gateway edge

Step-up: email accounts confirm with a mailed code (purpose=delete, no deeplink —
ConfirmByToken refuses a delete token so a stray click can't delete); platform-only
accounts type a fixed phrase (anti-impulse). Endpoints /user/delete/{request,confirm};
the confirm orchestration resigns active games, drops all-robot games, tombstones +
anonymizes the account (freeing its creds), and revokes its sessions — the tombstone is
the point of no return, the rest best-effort. Gateway account.delete.{request,confirm}
ops + fbs AccountDeleteConfirm/AccountDeleteRequestResult + branded ru/en delete email.
Integration tests cover the step-up (code + no-email) and the orchestration pieces.

gateway/internal/transcode/encode.go

@@ -37,6 +37,17 @@ func encodeAck(ok bool) []byte {
 	return b.FinishedBytes()
 }
 
+// encodeDeleteRequestResult builds an AccountDeleteRequestResult payload reporting which
+// deletion step-up the account uses ("email" | "phrase").
+func encodeDeleteRequestResult(method string) []byte {
+	b := flatbuffers.NewBuilder(32)
+	m := b.CreateString(method)
+	fb.AccountDeleteRequestResultStart(b)
+	fb.AccountDeleteRequestResultAddMethod(b, m)
+	b.Finish(fb.AccountDeleteRequestResultEnd(b))
+	return b.FinishedBytes()
+}
+
 // encodeConfirmLinkResult builds an EmailConfirmLinkResult payload, embedding the
 // minted Session for a login. All strings and the nested Session table are built
 // before the result table is opened.

gateway/internal/transcode/transcode_link.go

@@ -21,6 +21,8 @@ const (
 	MsgLinkUnlink         = "link.unlink"
 	MsgEmailChangeRequest = "link.email.change.request"
 	MsgEmailChangeConfirm = "link.email.change.confirm"
+	MsgAccountDeleteReq   = "account.delete.request"
+	MsgAccountDeleteConf  = "account.delete.confirm"
 )
 
 // registerLinkOps adds the linking & merge operations. The telegram ops need the
@@ -32,6 +34,8 @@ func registerLinkOps(r *Registry, backend *backendclient.Client, tg TelegramVali
 	r.ops[MsgLinkUnlink] = Op{Handler: linkUnlinkHandler(backend), Auth: true}
 	r.ops[MsgEmailChangeRequest] = Op{Handler: changeEmailRequestHandler(backend), Auth: true, Email: true}
 	r.ops[MsgEmailChangeConfirm] = Op{Handler: changeEmailConfirmHandler(backend), Auth: true, Email: true}
+	r.ops[MsgAccountDeleteReq] = Op{Handler: deleteRequestHandler(backend), Auth: true, Email: true}
+	r.ops[MsgAccountDeleteConf] = Op{Handler: deleteConfirmHandler(backend), Auth: true}
 	if tg != nil {
 		r.ops[MsgLinkTelegram] = Op{Handler: linkTelegramHandler(backend, tg, false), Auth: true}
 		r.ops[MsgLinkTelegramMerge] = Op{Handler: linkTelegramHandler(backend, tg, true), Auth: true}
@@ -94,6 +98,28 @@ func changeEmailConfirmHandler(backend *backendclient.Client) Handler {
 	}
 }
 
+// deleteRequestHandler starts account deletion, returning which step-up the account uses.
+func deleteRequestHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		res, err := backend.DeleteRequest(ctx, req.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return encodeDeleteRequestResult(res.Method), nil
+	}
+}
+
+// deleteConfirmHandler verifies the step-up proof and deletes the account.
+func deleteConfirmHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsAccountDeleteConfirm(req.Payload, 0)
+		if err := backend.DeleteConfirm(ctx, req.UserID, string(in.Code()), string(in.Phrase())); err != nil {
+			return nil, err
+		}
+		return encodeAck(true), nil
+	}
+}
+
 // linkUnlinkHandler detaches a platform identity (telegram|vk) from the caller and
 // returns the refreshed link result (status "unlinked" + the updated profile).
 func linkUnlinkHandler(backend *backendclient.Client) Handler {