Add self-service account deletion

Settings → Delete account removes the signed-in account and everything it
owns. DELETE /api/me re-checks the password (guarding an unattended session),
then wipes the user's events, config, sessions and user row in one transaction
and removes their photos/<user_id>/ directory. The client clears the account's
local cache and returns to the login screen.

Bumps the service-worker cache so clients pick up the new UI.

Verified: wrong password is rejected (401, data intact); correct password
returns 204, invalidates the session, drops all rows to zero and removes the
photo dir; the email can be re-registered afterwards. Confirmed end to end in
a headless-browser run of the Settings → delete flow.

README.md

@@ -82,6 +82,9 @@ events, profile and photos.
 - **First account adopts existing data.** When accounts are introduced on a DB
   that already had single-tenant data (or that imported a legacy `events.json`),
   the first account to register inherits all of it — events, profile and photos.
+- **Self-service deletion.** Settings → *Delete account* removes the signed-in
+  account and everything it owns (`DELETE /api/me`, re-confirming the password):
+  events, profile, sessions and the photo directory are all wiped.
 - **Serve over HTTPS in production.** Session cookies are only marked `Secure`
   when you pass `-secure-cookies` (enable it behind a TLS proxy), so passwords
   aren't sent in the clear.