Add delete account endpoint and file encryption at rest

Delete Account (Plan #2):
- DELETE /api/auth/account/ with password or "DELETE" confirmation
- Cascade delete across 15+ tables in correct FK order
- Auth provider detection (email/apple/google) for /auth/me/
- File cleanup after account deletion
- Handler + repository tests (12 tests)

Encryption at Rest (Plan #3):
- AES-256-GCM envelope encryption (per-file DEK wrapped by KEK)
- Encrypt on upload, auto-decrypt on serve via StorageService.ReadFile()
- MediaHandler serves decrypted files via c.Blob()
- TaskService email image loading uses ReadFile()
- cmd/migrate-encrypt CLI tool with --dry-run for existing files
- Encryption service + storage service tests (18 tests)

internal/handlers/auth_handler.go

@@ -22,6 +22,7 @@ type AuthHandler struct {
 	cache             *services.CacheService
 	appleAuthService  *services.AppleAuthService
 	googleAuthService *services.GoogleAuthService
+	storageService    *services.StorageService
 }
 
 // NewAuthHandler creates a new auth handler
@@ -43,6 +44,11 @@ func (h *AuthHandler) SetGoogleAuthService(googleAuth *services.GoogleAuthServic
 	h.googleAuthService = googleAuth
 }
 
+// SetStorageService sets the storage service for file deletion during account deletion
+func (h *AuthHandler) SetStorageService(storageService *services.StorageService) {
+	h.storageService = storageService
+}
+
 // Login handles POST /api/auth/login/
 func (h *AuthHandler) Login(c echo.Context) error {
 	var req requests.LoginRequest
@@ -406,3 +412,48 @@ func (h *AuthHandler) GoogleSignIn(c echo.Context) error {
 
 	return c.JSON(http.StatusOK, response)
 }
+
+// DeleteAccount handles DELETE /api/auth/account/
+func (h *AuthHandler) DeleteAccount(c echo.Context) error {
+	user, err := middleware.MustGetAuthUser(c)
+	if err != nil {
+		return err
+	}
+
+	var req requests.DeleteAccountRequest
+	if err := c.Bind(&req); err != nil {
+		return apperrors.BadRequest("error.invalid_request")
+	}
+
+	fileURLs, err := h.authService.DeleteAccount(user.ID, req.Password, req.Confirmation)
+	if err != nil {
+		log.Debug().Err(err).Uint("user_id", user.ID).Msg("Account deletion failed")
+		return err
+	}
+
+	// Delete files from disk (best effort, don't fail the request)
+	if h.storageService != nil && len(fileURLs) > 0 {
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					log.Error().Interface("panic", r).Uint("user_id", user.ID).Msg("Panic in file cleanup goroutine")
+				}
+			}()
+			for _, fileURL := range fileURLs {
+				if err := h.storageService.Delete(fileURL); err != nil {
+					log.Warn().Err(err).Str("file_url", fileURL).Msg("Failed to delete file during account cleanup")
+				}
+			}
+		}()
+	}
+
+	// Invalidate auth token from cache
+	token := middleware.GetAuthToken(c)
+	if h.cache != nil && token != "" {
+		if err := h.cache.InvalidateAuthToken(c.Request().Context(), token); err != nil {
+			log.Warn().Err(err).Msg("Failed to invalidate token in cache after account deletion")
+		}
+	}
+
+	return c.JSON(http.StatusOK, responses.MessageResponse{Message: "Account deleted successfully"})
+}