feat(server): deleting accounts and pruning abandoned ones

deletePerson deletes a person with everything they have, in one transaction and in ADR 0001 rule 6's order: their sessions first, since a device with a valid session would re-upload everything; then their memberships and personal space, whose foreign keys cascade into every synced table and the sync engine's bookkeeping; then the person, whose identities cascade. AccountEndpoint.delete deletes the caller and tells their devices that their sessions ended.

pruneAbandonedAnonymousPeople deletes, 500 at a time, anonymous people created and unused for 90 days: their sessions have expired and nobody can ever return to them. Identified people are never pruned. PruningFutureCall runs it daily at 03:17; the server schedules it at start, cancelling the previous entry by its identifier first, since scheduling always adds one.

Tests, refusal first: deleting when not signed in; deleting removes the caller, their sessions, their anonymous identity and the content of their space, and nobody else's; pruning takes the unused and the never-signed-in, and spares the recently used, newcomers and identified people.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

halkyon_learn_server/lib/server.dart

@@ -20,4 +20,16 @@ Future<void> run(List<String> args) async {
 
   // Start the server.
   await pod.start();
+
+  // Abandoned anonymous people are pruned daily (decided 2026-09-30).
+  // Scheduling always adds an entry, so the previous one goes first.
+  await pod.futureCalls.cancel(_pruning);
+  await pod.futureCalls
+      .callRecurring(identifier: _pruning)
+      .cron('17 3 * * *')
+      .pruning
+      .pruneAnonymousPeople();
 }
+
+/// The identifier of the daily pruning.
+const _pruning = 'prune-abandoned-anonymous-people';