fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

JobTrackerApi/Services/AccountDeletionService.cs

@@ -13,6 +13,7 @@ public sealed class AccountDeletionService(
     JobTrackerContext db,
     AccountOwnedFileInventory fileInventory,
     AccountDeletionTombstoneStore tombstones,
+    IAiSidecarCachePurger aiSidecarCache,
     IConfiguration configuration,
     IMemoryCache memoryCache,
     TimeProvider timeProvider,
@@ -313,7 +314,10 @@ public sealed class AccountDeletionService(
             file.Status = "purged";
         }
         if (memoryCache is MemoryCache cache) cache.Compact(1.0);
-        AppendWarning(request, "The local AI sidecar cache is content-keyed and ages out under its configured TTL; production deletion remains disabled until cache purge/restart is rehearsed.");
+        // The sidecar cache is content-keyed rather than owner-keyed, so deletion clears it
+        // globally. Keep this inside the durable stage: an unavailable sidecar leaves the request
+        // retryable and prevents a false completion/tombstone acknowledgement.
+        await aiSidecarCache.PurgeAsync(cancellationToken);
         request.Stage = AccountDeletionStages.RecordingTombstone;
         await db.SaveChangesAsync(cancellationToken);
     }