feat: account deletion, username reuse, and real-time username availability

- Add account deletion with tombstone (isDeleted flag), password/username
  confirmation, owned-space guard, and full cleanup transaction
- Free deleted usernames by renaming to !deleted:<id> so they can be reused
- Add migration to retroactively free usernames from already-tombstoned users
- Add GET /api/auth/check-username endpoint with rate limiting for real-time
  availability checking during registration
- Add debounced username availability indicator on registration Step 1
- Add DeleteAccountModal with federation-aware remote account cleanup
- Add federation ops utility for remote instance management
- Update sanitizeUser to anonymize deleted user profiles
- Add instance store improvements and connected instances modal updates

packages/server/src/utils/sanitize.ts

@@ -2,6 +2,28 @@ import type { User, ReplicatedInstance } from '@backspace/shared';
 import { schema } from '../db/index.js';
 
 export function sanitizeUser(row: typeof schema.users.$inferSelect): User {
+  // Tombstoned (deleted) users — return anonymized profile
+  if (row.isDeleted === 1) {
+    return {
+      id: row.id,
+      username: 'Deleted User',
+      displayName: null,
+      avatar: null,
+      banner: null,
+      accentColor: null,
+      avatarColor: null,
+      bio: null,
+      status: 'offline',
+      customStatus: null,
+      isAdmin: false,
+      isDeleted: true,
+      createdAt: row.createdAt,
+      homeInstance: null,
+      homeUserId: null,
+      replicatedInstances: [],
+    };
+  }
+
   let replicatedInstances: ReplicatedInstance[] = [];
   if (row.replicatedInstances) {
     try {