fix(admin): purge soft-deleted users after a grace period (#99)

[kipavy]

Closes #99.

Problem

Soft-deleted users kept their email reserved forever. Two causes:

• The nightly purge job promised by migration 028 never existed.
• admin_audit_log.target_id referenced users(id) with no ON DELETE action. Soft delete writes an audit row targeting the user, so no soft-deleted user could ever be hard-deleted, not even with force-delete.

Changes

• migrations/055_admin_audit_target_no_fk.sql drops that FK. Nothing joins the audit log to users, and the trail should outlive the user.
• src/user_purge.rs adds purge_expired, which runs at boot and in the daily retention loop. For each user soft-deleted longer ago than USER_PURGE_GRACE_DAYS (default 30):
  • Hard-delete the user and write a purge_user audit row in the same transaction.
  • If FKs still block the delete (team owner, team vault editor, audit actor), rewrite the email to <id>@purged.invalid and write a purge_user_release_email audit row once. The delete is retried on later runs.
• restore_user returns 409 once the email has been released.
• USER_PURGE_GRACE_DAYS is documented in .env.example and passed through compose.yml.

Migration 028's comment is left unchanged because sqlx checksums applied migrations and editing it would make boot fail.

Deploy note

The first boot purges every user already soft-deleted more than 30 days ago.

Tests

• A user past the grace period is purged and the email can be registered again (case-insensitive).
• Live users and users within the grace period are kept.
• An FK-blocked user gets the email released, audited once across two runs.
• Force-delete works after a soft delete.
• Restoring a user whose email was released returns 409.

cargo test --all-targets (683 passed) and cargo clippy --all-targets -- -D warnings pass locally.

🤖 Generated with Claude Code