feat(account): add deletion lifecycle

JobTrackerApi/Controllers/AuthController.cs

@@ -1087,6 +1087,8 @@ public sealed class AuthController : ControllerBase
     // decorative: skipping straight to AppSessionIssuer here would defeat the whole feature.
     private async Task<IActionResult> CompleteSignInAsync(ApplicationUser user, bool rememberMe, string provider, CancellationToken cancellationToken)
     {
+        if (user.DeletionStatus != AccountDeletionStatuses.Active)
+            return StatusCode(StatusCodes.Status403Forbidden, new { error = "account_deletion_pending" });
         // "Trust this device" cookie check happens BEFORE the 2FA gate: if it matches a
         // non-expired row for this exact user, skip straight to a real session, same as if 2FA
         // weren't required at all. Falls through to the normal gate for any other outcome