feat(web): account page with disconnect + delete-account

GET /account shows the registered display name, the signed-in email, the
user's connected video accounts (status + when), a Connect-YouTube link
when none is connected, and the disconnect / delete controls. Linked from
the header nav.

POST /account/disconnect/{provider}: deletes the OAuth token from the
SecretStore (resolved from the connection's own token_ref, provider-
agnostic) and the connection row. Does NOT delete the account.

POST /account/delete: confirm-before-destroy (a <details> disclosure gates
the destructive submit — works without JS). Captures token refs, calls
store.DeleteUser (cascades all rows), purges every secret, then routes to
/auth/logout to clear the session. Tapir-side only — Dex is left untouched
(decision 2026-06-03).

Account handlers depend on a narrow SecretRemover (Delete) and the extended
Store port; cmd/tapir serve shares one file-backed SecretStore between the
connect flow and account management.

Tests: account page renders connections + name + Connect link; disconnect
removes token (fake records Delete) + row and keeps the account; delete
wipes users/summaries/connections/identities and purges the token, then
redirects to logout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/main.go

@@ -186,7 +186,10 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 		log.Warn("web auth: STUB allow-all (no TAPIR_OIDC_ISSUER) — local dev only, do not expose")
 	}
 
-	app := &web.App{Store: st, Identity: st, Auth: authn, Log: log}
+	// The file-backed SecretStore is shared by the connect flow (writes tokens)
+	// and account management (deletes them on disconnect / delete-account).
+	secretStore := secrets.NewFileStore(cfg.SecretsFile)
+	app := &web.App{Store: st, Identity: st, Auth: authn, Secrets: secretStore, Log: log}
 
 	// Web-initiated YouTube connect (ADR-006). Mounted only when the OAuth client
 	// credentials are present; the refresh token persists through the SecretStore
@@ -197,7 +200,7 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 			ClientID:     cfg.YTClientID,
 			ClientSecret: cfg.YTClientSecret,
 			RedirectURL:  cfg.YTConnectRedirectURL,
-		}, secrets.NewFileStore(cfg.SecretsFile), st, log)
+		}, secretStore, st, log)
 		log.Info("web youtube connect enabled", "redirect", cfg.YTConnectRedirectURL)
 	}