feat: account deletion endpoints

crates/adapters/http-axum/templates/profile.html

@@ -97,6 +97,20 @@
   </section>
   {% endif %}
 
+  {% if ctx.is_admin && !is_own_profile %}
+  <section class="profile-manage">
+    <h3>Admin</h3>
+    {% if let Some(err) = error %}
+    <p class="error">{{ err }}</p>
+    {% endif %}
+    <form method="POST" action="/users/{{ profile_user_id }}/delete">
+      <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
+      <input type="password" name="password" placeholder="Your password" required autocomplete="current-password">
+      <button type="submit">Delete user</button>
+    </form>
+  </section>
+  {% endif %}
+
   <div class="view-tabs">
     <a href="?view=recent" class="view-tab {% if view == "recent" %}active{% endif %}">Recent</a>
     <a href="?view=ratings" class="view-tab {% if view == "ratings" %}active{% endif %}">Top Rated</a>

crates/adapters/http-axum/templates/profile_settings.html

@@ -7,6 +7,9 @@
 {% if saved %}
 <p class="success">Saved.</p>
 {% endif %}
+{% if let Some(err) = error %}
+<p class="error">{{ err }}</p>
+{% endif %}
 <form method="post" action="/settings/profile" enctype="multipart/form-data">
   <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
 
@@ -62,4 +65,19 @@
   <p style="font-size:.85em;opacity:.7;margin-bottom:.5rem">Add your diary to your blog or website:</p>
   <pre style="background:rgba(255,255,255,0.06);padding:12px;border-radius:8px;font-size:.8em;overflow-x:auto;white-space:pre-wrap;word-break:break-all"><code>&lt;iframe src="{{ embed_url }}" width="100%" height="600" style="border:none;border-radius:8px" loading="lazy"&gt;&lt;/iframe&gt;</code></pre>
 </section>
+
+<section style="margin-top:2rem;padding-top:1rem;border-top:1px solid rgba(255,255,255,0.1)">
+  <h3>Delete account</h3>
+  <p style="font-size:.85em;opacity:.7;margin-bottom:.5rem">
+    Permanently removes your account and everything on it: reviews, watchlist, goals, follows and uploaded images. This cannot be undone.
+  </p>
+  <form method="post" action="/settings/account/delete">
+    <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
+    <label>
+      Confirm with your password<br>
+      <input type="password" name="password" required autocomplete="current-password">
+    </label>
+    <button type="submit">Delete my account</button>
+  </form>
+</section>
 {% endblock %}