Add self-service account deletion

Settings → Delete account removes the signed-in account and everything it
owns. DELETE /api/me re-checks the password (guarding an unattended session),
then wipes the user's events, config, sessions and user row in one transaction
and removes their photos/<user_id>/ directory. The client clears the account's
local cache and returns to the login screen.

Bumps the service-worker cache so clients pick up the new UI.

Verified: wrong password is rejected (401, data intact); correct password
returns 204, invalidates the session, drops all rows to zero and removes the
photo dir; the email can be re-registered afterwards. Confirmed end to end in
a headless-browser run of the Settings → delete flow.

server/main.go

@@ -423,7 +423,16 @@ func main() {
 	mux.HandleFunc("/api/register", auth.handleRegister)
 	mux.HandleFunc("/api/login", auth.handleLogin)
 	mux.HandleFunc("/api/logout", auth.handleLogout)
-	mux.HandleFunc("/api/me", auth.requireUser(auth.handleMe))
+	mux.HandleFunc("/api/me", auth.requireUser(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet:
+			auth.handleMe(w, r)
+		case http.MethodDelete:
+			auth.handleDeleteAccount(w, r)
+		default:
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		}
+	}))
 
 	mux.HandleFunc("/api/events/sync", auth.requireUser(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {