fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

JobTrackerApi/Program.cs

@@ -49,6 +49,7 @@ builder.Services.AddScoped<EmailSendAttemptStore>();
 builder.Services.AddScoped<AccountOwnedFileInventory>();
 builder.Services.AddScoped<AccountDataExportService>();
 builder.Services.AddSingleton<AccountDeletionTombstoneStore>();
+builder.Services.AddScoped<IAiSidecarCachePurger, AiSidecarCachePurger>();
 builder.Services.AddScoped<AccountDeletionService>();
 builder.Services.AddScoped<AiOperationAdmission>();
 builder.Services.AddScoped<StrategySnapshotService>();