feat(mobile): add in-app permanent account deletion

[xiaoland]

Cross-repo context

One-third of CODE-292 (App Store Guideline 5.1.1(v) in-app account deletion). This is the mobile-facing surface: a destructive entry point in Account settings, re-authentication, the single delete request, and local teardown.

Companion PRs: [linkcodehq#51], [auth#20]. Design and the full verification record live in tasks/CODE-292/ in this repo — intentionally untracked (.gitignore'd) so it doesn't ship as product documentation; see tasks/CODE-292/verification.md for the full local E2E acceptance record and tasks/CODE-292/scripts/ for the reproducible black-box verification scripts.

Summary

• deleteAccount(): re-authenticates (Apple native re-auth on that branch, a re-run of the existing browser IdP sign-in on the other — mobile has no reliable signal for which central-identity provider a given account actually uses, D-19/D-21), sends one DELETE /account, and interprets the two independent response dimensions (status, siwaRevocation) into a discriminated outcome.
• runAccountDeletionTeardown(): local cleanup once the server has accepted deletion (whencompleted and pending — never for a rejected/unreached request) — sign-out, IdP sign-out, device-enrollment clear, and removal of every tunnel-derived host profile (direct/LAN hosts, which aren't account-issued, are left alone).
• No retry button by design: the server is idempotent on replay, so a retry only risks the user repeating an already-effective destructive action.

Known gaps (non-blocking)

• Maestro / real-device UI acceptance (mobile-release.md 05-VR) not yet run.
• The Apple/SIWA revocation branch is unverified end-to-end (blocked on missed real Apple credentials).

[linear-code]

CODE-292

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

The PR adds an in-app account-deletion flow for mobile, including reauthentication, server submission, localized confirmation and outcome messaging, and account-scoped local cleanup.

• Adds the destructive account-settings entry point and confirmation flow.
• Adds Apple and browser-based reauthentication paths.
• Adds deletion response parsing, teardown logic, and unit coverage.
• Adds configurable Cloud and central IdP development endpoints.

Confidence Score: 3/5

The PR is not yet safe to merge because malformed responses can trigger destructive teardown and failed cleanup steps can leave durable account state without any retry.

A schema-invalid response still becomes pending, causing the caller to clear local account state and claim deletion was received without a valid server status; separately, teardown failures are swallowed without a durable marker or lifecycle retry, so credentials, enrollment, or tunnel profiles can remain after deletion.

Files Needing Attention: apps/mobile/src/runtime/cloud/deletion.ts and apps/mobile/src/components/account/delete-account-section.tsx

Important Files Changed

Filename	Overview
apps/mobile/src/runtime/cloud/deletion.ts	Implements deletion outcome classification and best-effort local teardown; previously reported correctness issues remain unresolved.
apps/mobile/src/components/account/delete-account-section.tsx	Adds confirmation, deletion orchestration, teardown invocation, and localized outcome alerts.
apps/mobile/src/runtime/cloud/idp.ts	Refactors native Apple authentication to return fresh identity and authorization credentials for deletion.
apps/mobile/src/runtime/cloud/tests/deletion.test.ts	Adds initial unit coverage for deletion classification and teardown behavior.
apps/mobile/src/runtime/cloud/client.ts	Adds an optional build-time Cloud API origin override while preserving the production default.

Sequence Diagram

sequenceDiagram
  actor User
  participant UI as Account settings
  participant IdP as Identity provider
  participant Cloud as Cloud API
  participant Local as Local device state
  User->>UI: Confirm account deletion
  UI->>IdP: Reauthenticate
  IdP-->>UI: Fresh identity proof
  UI->>Cloud: DELETE /account
  Cloud-->>UI: completed, pending, or rejected
  alt completed or pending
    UI->>Local: Sign out and remove account-scoped state
    UI-->>User: Show deletion outcome
  else rejected
    UI-->>User: Show failure
  end

Loading

_{Reviews (3): Last reviewed commit: "refactor(mobile): rename siwaRevocation ..." | Re-trigger Greptile}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[xiaoland]

Pushed a fix for the transport-failure P1 (7343154): a thrown fetch (no HTTP response ever received) now returns { kind: 'failed' } instead of { kind: 'pending' } — no local teardown, no "deletion received" message, and the user can safely retry since the server's deletion CAS is idempotent either way. The unparseable-success-body case is unchanged (pending) since an HTTP 2xx did occur there.

Recorded as D-23 in the task packet (gitignored, local only). Two things from that review thread are deliberately deferred, not fixed here:

• The second P1 (failed teardown steps are never retried on next launch/foreground) — real gap, no code change in this pass.
• The fuller idempotency-key + deletion-status/replay-endpoint design you suggested — not required for correctness given the existing idempotent CAS, but would remove the need for a blind client retry. Follow-up.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.