feat: account deletion, username reuse, and real-time username availability

- Add account deletion with tombstone (isDeleted flag), password/username
  confirmation, owned-space guard, and full cleanup transaction
- Free deleted usernames by renaming to !deleted:<id> so they can be reused
- Add migration to retroactively free usernames from already-tombstoned users
- Add GET /api/auth/check-username endpoint with rate limiting for real-time
  availability checking during registration
- Add debounced username availability indicator on registration Step 1
- Add DeleteAccountModal with federation-aware remote account cleanup
- Add federation ops utility for remote instance management
- Update sanitizeUser to anonymize deleted user profiles
- Add instance store improvements and connected instances modal updates

packages/shared/src/types.ts

@@ -15,6 +15,7 @@ export interface User {
   status: UserStatus;
   customStatus: string | null;
   isAdmin: boolean;
+  isDeleted?: boolean;
   createdAt: number;
   homeInstance: string | null;
   homeUserId: string | null;
@@ -482,3 +483,17 @@ export interface VerifyPasswordRequest {
 export interface VerifyPasswordResponse {
   valid: boolean;
 }
+
+export interface ChangePasswordRequest {
+  currentPassword?: string;  // Required on home, optional for federated users
+  newPassword: string;
+}
+
+export interface ChangePasswordResponse {
+  token: string;
+}
+
+export interface DeleteAccountRequest {
+  password: string;
+  username: string;  // Must match — confirmation safeguard
+}