control: self-service account deletion
account delete --confirm (gitbay auth delete, and a section at the bottom of /settings) mails a link to the primary verified address. Opening it at /settings/delete disables the account and sets users.delete_after seven days out. A web login or any command over SSH with a full-scope key cancels; other key scopes and API tokens are refused and cannot. An admin disable or enable replaces the schedule.
The gitbayd reaper purges due accounts hourly: owned repositories go through the repo delete path, issues, MRs, comments, diff comments and reviews on other owners' repositories move to a ghost account (created on first use, disabled, reserved name), then DeleteUser. The only admin of an org is refused at request time and skipped at purge.
Spec: docs/specs/2026-10-02-account-delete-design.md
Closes #322