Add self-service account deletion

Settings → Delete account removes the signed-in account and everything it
owns. DELETE /api/me re-checks the password (guarding an unattended session),
then wipes the user's events, config, sessions and user row in one transaction
and removes their photos/<user_id>/ directory. The client clears the account's
local cache and returns to the login screen.

Bumps the service-worker cache so clients pick up the new UI.

Verified: wrong password is rejected (401, data intact); correct password
returns 204, invalidates the session, drops all rows to zero and removes the
photo dir; the email can be re-registered afterwards. Confirmed end to end in
a headless-browser run of the Settings → delete flow.

src/index.html

@@ -192,6 +192,26 @@
           <button value="cancel" class="ghost">Cancel</button>
           <button value="save" id="settings-save">Save</button>
         </menu>
+        <hr class="settings-sep" />
+        <button type="button" id="delete-account-btn" class="danger danger-block">Delete account…</button>
+      </form>
+    </dialog>
+
+    <dialog id="delete-account-dialog">
+      <form method="dialog" id="delete-account-form">
+        <h3>Delete account</h3>
+        <p class="danger-text">
+          This permanently deletes your account and <strong>all its data</strong> —
+          every event, photo and your puppy profile. This can't be undone.
+        </p>
+        <label>Confirm your password
+          <input type="password" id="delete-account-password" autocomplete="current-password" />
+        </label>
+        <p id="delete-account-error" class="auth-error" hidden></p>
+        <menu>
+          <button value="cancel" class="ghost">Cancel</button>
+          <button type="button" id="delete-account-confirm" class="danger">Delete forever</button>
+        </menu>
       </form>
     </dialog>