feat: account deletion request and active-user check

crates/domain/tests/testing/in_memory_store_test.rs

@@ -628,3 +628,33 @@ async fn fake_mark_deleted_mirrors_the_sqlite_tombstone() {
     assert_eq!(store.refresh_session_count(), 0);
     assert_eq!(store.recorded_events().len(), 1);
 }
+
+#[tokio::test]
+async fn fake_mark_deleted_refuses_unknown_and_already_deleted_users() {
+    let store = InMemoryStore::new();
+    let user = test_user("ghost");
+    UserRepository::save(&*store, &user).await.unwrap();
+    let event = domain::events::DomainEvent::UserDeleted {
+        user_id: user.id().clone(),
+    };
+
+    let unknown = store
+        .mark_deleted(&UserId::generate(), std::slice::from_ref(&event))
+        .await;
+    assert!(matches!(unknown, Err(DomainError::NotFound(_))));
+    assert!(store.recorded_events().is_empty());
+
+    store
+        .mark_deleted(user.id(), std::slice::from_ref(&event))
+        .await
+        .unwrap();
+    let again = store
+        .mark_deleted(user.id(), std::slice::from_ref(&event))
+        .await;
+    assert!(matches!(again, Err(DomainError::NotFound(_))));
+    assert_eq!(
+        store.recorded_events().len(),
+        1,
+        "second call records nothing"
+    );
+}