feature: Implement Account Deletion Mechanics

[builtbykabir]

Implement Account Deletion Mechanics

Description

Currently, users (both Adventurers and Companies) have no way to permanently delete their accounts from the platform. There are no UI buttons in the Profile Settings, and there is no backend API endpoint (DELETE /api/users/me) to handle the deletion request.

Root Cause & Database Risks

In prisma/schema.prisma, many core relations (like companyId on a Quest, or reviewerId on a QuestSubmission) do NOT have onDelete: Cascade.

By default, Prisma sets optional relations to SetNull. This means if a company deletes their account, all of their quests will be left completely orphaned in the database, potentially breaking frontend pages that expect a quest to have an associated company.

Proposed Fix

We need to implement a full-stack account deletion flow, carefully handling the cascading deletion logic to avoid database constraint errors or orphaned data.

1. Update the Frontend UI:
Modify both app/dashboard/profile/page.tsx (Adventurer) and app/dashboard/company/profile/page.tsx (Company).
Inside the "Security" section, add a red "Delete Account" button.

• Clicking this button MUST trigger a high-friction confirmation modal (e.g., "Type DELETE to confirm") to prevent accidental deletion.

2. Update schema.prisma Cascade Logic:
Before implementing the backend route, you MUST audit prisma/schema.prisma and explicitly define what happens when a User is deleted.

• Evaluate if we want a soft-delete (e.g., setting isActive = false and anonymizing PII) versus a hard-delete.
• If implementing a hard-delete, add onDelete: Cascade to relevant relations (like Quest -> companyId) so deleting a company safely deletes their quests, and deleting a quest safely deletes its assignments.

3. Implement the Backend API:
Create a DELETE endpoint at app/api/users/me/route.ts.

• Verify the user's session.
• Run the prisma.user.delete() operation (which will respect the Cascade rules defined in step 2) OR execute the soft-delete logic.
• Destroy the user's active session/cookies.
• Return a success response so the client can instantly redirect them to the homepage.

Acceptance Criteria

• Users can trigger an account deletion from their profile settings via a confirmation modal.
• Database relations are explicitly handled (either via Cascade deletion or explicit SetNull/anonymization) so no orphaned data causes 500 errors on the frontend.
• Upon successful deletion, the user is logged out and redirected to the home page.