fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

JobTrackerApi/Services/AccountDeletionService.cs

@@ -13,6 +13,7 @@ public sealed class AccountDeletionService(
     JobTrackerContext db,
     AccountOwnedFileInventory fileInventory,
     AccountDeletionTombstoneStore tombstones,
+    IAiSidecarCachePurger aiSidecarCache,
     IConfiguration configuration,
     IMemoryCache memoryCache,
     TimeProvider timeProvider,
@@ -313,7 +314,10 @@ public sealed class AccountDeletionService(
             file.Status = "purged";
         }
         if (memoryCache is MemoryCache cache) cache.Compact(1.0);
-        AppendWarning(request, "The local AI sidecar cache is content-keyed and ages out under its configured TTL; production deletion remains disabled until cache purge/restart is rehearsed.");
+        // The sidecar cache is content-keyed rather than owner-keyed, so deletion clears it
+        // globally. Keep this inside the durable stage: an unavailable sidecar leaves the request
+        // retryable and prevents a false completion/tombstone acknowledgement.
+        await aiSidecarCache.PurgeAsync(cancellationToken);
         request.Stage = AccountDeletionStages.RecordingTombstone;
         await db.SaveChangesAsync(cancellationToken);
     }

JobTrackerApi/Services/AiSidecarCachePurger.cs

@@ -0,0 +1,16 @@
+namespace JobTrackerApi.Services;
+
+public interface IAiSidecarCachePurger
+{
+    Task PurgeAsync(CancellationToken cancellationToken);
+}
+
+public sealed class AiSidecarCachePurger(IHttpClientFactory clients) : IAiSidecarCachePurger
+{
+    public async Task PurgeAsync(CancellationToken cancellationToken)
+    {
+        using var response = await clients.CreateClient("ai-service")
+            .DeleteAsync("/maintenance/cache", cancellationToken);
+        response.EnsureSuccessStatusCode();
+    }
+}