users: add authenticated self-delete endpoint

POST /delete (auth) wipes every key tied to the calling user, mirroring
scripts/delall-legacy.ts: user records, payments/invoices, sub-accounts,
NWC apps, nostr follow graph + nip5. Gated by typing the username and
refuses while balance+pending > 10k sats so funds can't be destroyed by
accident.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

1 files changed, 1 insertions, 0 deletions

diff --git a/index.ts b/index.ts
index 3b90d32b..0a3bfd89 100644
--- a/index.ts
+++ b/index.ts
@@ -123,6 +123,7 @@ app.post("/register", users.create);
 app.post("/disable2fa", auth, users.disable2fa);
 app.post("/2fa", auth, users.enable2fa);
 app.post("/user", auth, users.update);
+app.post("/delete", auth, users.deleteSelf);
 app.post("/reset", optional, users.reset);
 app.post("/upload/:type", users.upload);
 app.get("/users/delete/:username", users.del);