0.6.0 — account deletion two ways, and nightly backups

Account deletion — the one server-side thing the stores require before submission — now ships two ways. A SECURITY DEFINER Postgres function, delete_own_account(), arrives by migration (20260905120000) and is called with supabase.rpc: it deletes only auth.uid(), is executable by signed-in users only, and works the moment your first release runs the migrations — no API deploy needed. And the API keeps DELETE /auth/users/me (app/routes/auth_router.py), the same deletion done by the server with the service-role key. The mobile app (0.7.0) ships both and one constant picks: ACCOUNT_DELETION in src/lib/api.ts, 'database' by default.

Also since 0.5.4: the nightly database backup workflow (0.5.5), [inbucket] renamed to [local_smtp] in supabase/config.toml, and a CLAUDE.md that carries the production rule (never write to the hosted database by hand — schema changes are migrations that ride releases), the storage rules, and how this ships. Package version stays 0.0.1 by design.