fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

docker-compose.yml

@@ -6,10 +6,15 @@ services:
       dockerfile: JobTrackerApi/Dockerfile
     volumes:
       - jobtracker_data:/data
+      # Kept outside restored application data so an older database/data backup cannot erase the
+      # deletion ledger used to detect and re-delete resurrected accounts.
+      - jobtracker_deletion_tombstones:/account-lifecycle/tombstones
     environment:
       - ASPNETCORE_URLS=http://+:8080
       - Data__Root=/data
       - Exports__DailyFolder=/data/exports
+      - AccountLifecycle__DeletionEnabled=${ACCOUNT_DELETION_ENABLED:-false}
+      - AccountLifecycle__TombstonesRoot=/account-lifecycle/tombstones
       - Database__Provider=${DATABASE_PROVIDER:-sqlite}
       - ConnectionStrings__JobTracker=${JOBTRACKER_CONNECTION_STRING}
       # If you enable HTTPS at a reverse proxy (recommended), handle redirects there.
@@ -230,6 +235,7 @@ services:
 
 volumes:
   jobtracker_data:
+  jobtracker_deletion_tombstones:
   ollama_data:
 
 networks: