c904e3e2db
POST /user/delete (auth required) verifies the password via pass1 and transactionally removes the user's sessions, votes, entries and the user row, then clears the session cookie. Associated media files are removed best effort after commit. This was only a stub in the Flask original. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>