tombstone gate all user paths; cleanup deletes late follower rows; spa self-delete to /; adr 0016 + purge comment

crates/application/src/users/purge_account.rs

@@ -20,6 +20,10 @@ use domain::{
 ///
 /// Idempotent: every step is a no-op on a re-run, and the notification is
 /// skipped once the account is purged.
+///
+/// A purge that fails after the notification was queued is redelivered and
+/// queues the `Delete` again. That is harmless: a repeated `Delete` of an
+/// already deleted actor is idempotent on remote servers.
 pub struct AccountPurgeHandler {
     user: Arc<dyn UserRepository>,
     notifier: Arc<dyn FederationDeletionNotifier>,