[Eoic]

Add a recoverable account-deletion lifecycle with a 30-day window, explicit recovery, ordered lifecycle emails, and permanent cleanup. User responses also expose connected providers so the client can identify linked Google accounts.

• Signed-in deletion uses the current session and revokes existing credentials. The public deletion page supports password and linked-Google authentication.
• Sign-in during the recovery window grants restricted recovery authorization. Explicit cancellation restores the account and issues a new session atomically.
• Pending deletion blocks sync, media writes, and acquisition claims. The cleanup worker purges expired accounts and retries physical media cleanup.
• Lifecycle notices are queued transactionally and delivered in order with SMTP retries. Password recovery uses the same HTML/plain-text email styling.

Updated against current development, including merged support PR #41. The PR diff contains only account-deletion changes. The stale user-column assertion that failed the previous CI run now includes both deletion timestamps.

Validation: 144 focused PostgreSQL-backed server tests and 26 client deletion/recovery tests passed. The full server run passed 457 tests, with only the ignored local .env key-alignment check failing. After adding missing defaults without changing effective settings, all five environment/model checks passed. Two external provider smoke tests were excluded. Ruff, formatting, Mypy (186 files), and the OpenAPI snapshot freshness check passed. Live provider delivery and production deployment were not rerun.

Deployment: run alembic upgrade head through a8b9c0d1e234, then deploy the server before releasing the client. The former disable-only DELETE /users/me route is replaced. Existing PowerSync tokens expire naturally. Automated backups remain unimplemented, with a configurable retention notice and a planned 30-day limit for future backups.

Companion client #73 and docs #85 are already merged. The combined API snapshot is included in merged docs #86.

Related: FR-1_6, UC-1_6. This does not close the requirement: the app's exact dated preview and live deployment acceptance remain documented gaps.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T13:09:37.322065Z	56b9d14	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.