feat: Implement account deletion (mark for removal) feature

- Added `marked_for_deletion` and `marked_for_deletion_at` fields to User model (Python and TypeScript) with serialization updates
- Created POST /api/user/mark-for-deletion endpoint with JWT auth, error handling, and SSE event trigger
- Blocked login and password reset for marked users; added new error codes ACCOUNT_MARKED_FOR_DELETION and ALREADY_MARKED
- Updated UserProfile.vue with "Delete My Account" button, confirmation modal (email input), loading state, success/error modals, and sign-out/redirect logic
- Synced error codes and model fields between backend and frontend
- Added and updated backend and frontend tests to cover all flows and edge cases
- All Acceptance Criteria from the spec are complete and verified

backend/api/auth_api.py

@@ -12,7 +12,7 @@ from config.paths import get_user_image_dir
 
 from api.error_codes import MISSING_FIELDS, EMAIL_EXISTS, MISSING_TOKEN, INVALID_TOKEN, TOKEN_TIMESTAMP_MISSING, \
     TOKEN_EXPIRED, ALREADY_VERIFIED, MISSING_EMAIL, USER_NOT_FOUND, MISSING_EMAIL_OR_PASSWORD, INVALID_CREDENTIALS, \
-    NOT_VERIFIED
+    NOT_VERIFIED, ACCOUNT_MARKED_FOR_DELETION
 from db.db import users_db
 from api.utils import normalize_email
 
@@ -146,6 +146,10 @@ def login():
     if not user.verified:
         return jsonify({'error': 'This account has not verified', 'code': NOT_VERIFIED}), 403
 
+    # Block login for marked accounts
+    if user.marked_for_deletion:
+        return jsonify({'error': 'This account has been marked for deletion and cannot be accessed.', 'code': ACCOUNT_MARKED_FOR_DELETION}), 403
+
     payload = {
         'email': norm_email,
         'user_id': user.id,
@@ -196,12 +200,14 @@ def request_password_reset():
     user_dict = users_db.get(UserQuery.email == norm_email)
     user = User.from_dict(user_dict) if user_dict else None
     if user:
-        token = secrets.token_urlsafe(32)
-        now_iso = datetime.utcnow().isoformat()
-        user.reset_token = token
-        user.reset_token_created = now_iso
-        users_db.update(user.to_dict(), UserQuery.email == norm_email)
-        send_reset_password_email(norm_email, token)
+        # Silently ignore reset requests for marked accounts (don't leak account status)
+        if not user.marked_for_deletion:
+            token = secrets.token_urlsafe(32)
+            now_iso = datetime.utcnow().isoformat()
+            user.reset_token = token
+            user.reset_token_created = now_iso
+            users_db.update(user.to_dict(), UserQuery.email == norm_email)
+            send_reset_password_email(norm_email, token)
 
     return jsonify({'message': success_msg}), 200