fix(account): close deletion cache gap

Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.

docs/deployment/backup-restore.md

@@ -85,11 +85,12 @@ MYSQL_PWD='<pw>' mariadb --host=<host> --user=<user> --default-character-set=utf
 
 ## Production access
 
-**This environment has no route to the production database** — no `/opt/job-tracker`, no production
-connection string, and the local stack runs SQLite. Per the task constraints, **no credential
-discovery and no SSH guessing were attempted.**
+A sanitized read-only host inventory was completed on 2026-08-15. It verified the integrity of the
+existing compressed database dumps without reading private rows or restoring data. The newest
+observed dump was dated 2026-08-02, and the set is database-only: it does not prove recovery of owned
+files, data-protection keys, configuration, or account-deletion tombstones.
 
-**Manual step the owner must perform** (only the owner has production access):
+**Authorized production steps still required:**
 
 1. On the production host, run one out-of-band backup: `deploy/deploy.sh` takes one automatically, or
    dump by hand with the command in `deploy/README.md`.
@@ -97,6 +98,10 @@ discovery and no SSH guessing were attempted.**
    - table count (~42) and row counts for `AspNetUsers`, `JobApplications`, `Companies`,
      `CareerProfiles` match production;
    - a real record containing `æ`/`ø`/`å` reads back correctly (the check above).
+3. Build and restore a complete recovery bundle covering the `jobtracker_data` volume and deployment
+   data-protection keys as well as MariaDB. Preserve the separately mounted
+   `jobtracker_deletion_tombstones` volume across application-data restores; never overwrite it with
+   an older backup capable of resurrecting a deleted identity.
 
 Until that is done, backup/restore is proven **on the mechanism and on synthetic Norwegian data**, not
 on the production dataset.