Add account deletion, data export and a retention sweep

[PianoNic]

Summary

• Adds IAccountPurger, one service that erases everything stored about a user: school users and their grades, absences, agenda entries, semester reports, subject grades, documents and class memberships, plus the account row. The per-user deletions are a single named list of purge steps, so a new user-scoped table is a two-line addition.
• Student document blobs are removed from S3 through IDocumentStorage.DeleteAsync after the database transaction commits; a missing or unreachable object is logged and counted, never fatal.
• Teacher rows linked to the account are unlinked rather than deleted - they are school-owned master data referenced by classes, which is what DeleteBehavior.SetNull on the FK already says.
• DELETE /api/auth/me purges the caller's data and then deletes the Keycloak user through the admin REST API using a service-account client (Oidc:AdminClientId / Oidc:AdminClientSecret). Unconfigured, or any failure against Keycloak, logs a warning and leaves local deletion successful.
• GET /api/auth/me/export returns everything stored about the caller as schuly-export.json.
• Retention sweep as a hosted service: first pass five minutes after startup, then daily. Drops cached school data for school users whose LeaveDate is older than Retention:MonthsAfterLeave (6), and accounts with no authenticated request for Retention:MonthsInactive (12). Both, and Retention:Enabled, are configurable; it reuses the same purge code.
• "Inactive" is defined by a new nullable ApplicationUser.LastSeenAt, stamped from the JWT validation pipeline at most once an hour, falling back to CreatedAt for accounts predating the column. The sweep never touches identity-provider users, so a swept account can sign in again and resync.
• Purge logging carries a hashed user id and row counts only, no personal data.
• Plugin vault entries are left alone and the reason is recorded in code: a VaultEntry is keyed by plugin namespace and an opaque key, with no user dimension to match on.

Closes #274