feat: 10 quick wins — account deletion, health check, debug cleanup, UX polish, graceful shutdown

- backend/handlers/user/account.go: Wire DELETE /api/user/account to call
  anonymize_user() for registered users and delete_guest_user() for guests,
  with CardDAV contact cleanup
- backend/handlers/user/profile_test.go: Add TestAccount_DeleteGuest and
  enhance TestAccount_Delete to verify anonymization results
- backend/main.go: Add GET /api/health endpoint with DB ping and S3 status
  check; add HSTS and Referrer-Policy security headers; replace
  http.ListenAndServe with http.Server + graceful SIGTERM/SIGINT shutdown
- frontend/routes/+layout.svelte: Replace alert() with toast notifications
  for email verification flow
- frontend/routes/login/+page.svelte: Replace alert() with toast.info for
  social login prototype buttons
- frontend/booking/BookingFlow.svelte: Remove 2 console.log debug calls;
  add cancellation policy note in Step 3; add timezone policy comment
- frontend/ImageUpload.svelte: Comment out debug console.log
- init-scripts/init-script.sql: Add delete_guest_user() SQL function
- docs: Update README.md and Obsidian notes to reflect completed items

init-scripts/init-script.sql

@@ -534,6 +534,17 @@ BEGIN
 END;
 $$ LANGUAGE plpgsql;
 
+-- Delete guest user completely (no contractual retention basis)
+-- WHY: Guest accounts have no ongoing contractual or legal basis for retention
+-- WHEN: User requests deletion or GDPR cleanup
+-- OUTPUT: Full removal of guest account from users table
+CREATE OR REPLACE FUNCTION delete_guest_user(target_id CHAR(12))
+RETURNS VOID AS $$
+BEGIN
+    DELETE FROM users WHERE id = target_id AND account_role = 'guest';
+END;
+$$ LANGUAGE plpgsql;
+
 -- Update consent
 -- WHY: GDPR requires tracking consent changes
 -- WHEN: User updates privacy preferences