fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/user/account.go

@@ -338,6 +338,26 @@ func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// FIX: admin accounts cannot be self-deleted
+	if accountRole == "admin" {
+		http.Error(w, "admin accounts cannot be self-deleted", http.StatusForbidden)
+		return
+	}
+
+	// FIX: check for active bookings before guest deletion
+	if accountRole == "guest" {
+		var bookingCount int
+		if err := db.Conn.QueryRow(r.Context(), `SELECT COUNT(*) FROM bookings WHERE user_id = $1 AND status IN ('pending', 'confirmed', 'in_progress', 'pending_release')`, userID).Scan(&bookingCount); err != nil {
+			log.Printf("Failed to check bookings for guest %s: %v", userID, err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		if bookingCount > 0 {
+			http.Error(w, "cannot delete guest account with active bookings", http.StatusBadRequest)
+			return
+		}
+	}
+
 	ctx := r.Context()
 
 	// Finding 3: deleting an account is irreversible, so the session token alone