docs: account deletion = legal retention, not erasure

FUNCTIONAL (+ru): the deletion user story — anonymised live surfaces ([Deleted]),
freed sign-in methods, a two-year-retained dossier, the code/phrase step-up, game
forfeit + all-robot drop, fresh account on reopen. ARCHITECTURE: the retention model
(retained_identities journal on every detach, tombstone + [Deleted] sentinel, drop
all-robot games, purpose=delete step-up, cold-load last-login, two-year TTL reaper).

docs/FUNCTIONAL.md

@@ -117,6 +117,16 @@ address that already belongs to another account is refused with a neutral "check
 address or contact support" — the switch never merges and never reveals the other
 account.
 
+A player can **delete their account**. This is a legal-retention removal, not an erasure:
+the account is deactivated and its live surfaces anonymised (opponents see "[Deleted]"), its
+sign-in methods are freed for reuse, and its sessions are revoked — but a dossier (the
+credentials that were linked, the last login, and the player's messages) is retained for
+the operator and purged after two years. Confirming deletion needs a mailed code for an
+account with an email, or a typed phrase otherwise. Active games are forfeited so opponents
+are not stranded; solo games against the AI are removed, while games with a human opponent
+are kept under the anonymised name and the player's chat stays. Reopening the app after
+deletion simply creates a fresh account.
+
 ### Lobby & matchmaking
 On a cold open the lobby greets the player with a brief **loading splash** — Scrabble tiles
 spelling **ЭРУДИТ / ЗАГРУЗКА / ОЖИДАНИЕ** as a small crossword — that clears the moment the