delete_account: re-check the master password, delete on the server, wipe the device

VaultCore::delete_account verifies the password against the keyset (Secret Key from its sealed copy),
calls DELETE /v1/account when a server is configured (needs a session; a failure deletes nothing),
then wipes the local store and keeps only the device identity. Unit test plus a live test against a
real server.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-ffi/tests/live_server.rs

@@ -9,7 +9,8 @@
 //!   cargo test -p kv-ffi --test live_server -- --ignored --nocapture
 //! ```
 //! The setup code works once, so restart the server with an empty database for every run (one test per run:
-//! `two_devices_against_local_server` or `removed_device_reenrols_against_local_server`). They take a few minutes
+//! `two_devices_against_local_server`, `removed_device_reenrols_against_local_server` or
+//! `delete_account_against_local_server`). They take a few minutes
 //! because they wait out the server's rate limit on the login endpoints.
 
 use std::sync::Arc;
@@ -193,3 +194,29 @@ async fn removed_device_reenrols_against_local_server() {
     assert!(matches!(web.approve_device(old_id).await, Err(CoreError::NotFound)));
     println!("removed device re-enrolled OK against {url}");
 }
+
+#[tokio::test]
+#[ignore = "needs a fresh local kestrove-server; see the module docs"]
+async fn delete_account_against_local_server() {
+    let url = std::env::var("KESTROVE_SERVER_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".into());
+    let token =
+        std::env::var("KESTROVE_SETUP_TOKEN").expect("set KESTROVE_SETUP_TOKEN to the token the server printed");
+    let pw = "a long master password for the live test";
+
+    let app = VaultCore::new_in_memory();
+    app.create_account(pw.into()).unwrap();
+    connect(&app, &url, "phone");
+    app.register_account(token.clone()).await.unwrap();
+    app.save_item(item("Bank", "pw-a")).unwrap();
+    app.sync_now().await.unwrap();
+
+    assert!(matches!(app.delete_account("wrong".into()).await, Err(CoreError::BadCredentials)));
+    app.delete_account(pw.into()).await.unwrap();
+    assert!(!app.has_account());
+    // The server forgot the account: setup is open again and accepts its configured code.
+    let fresh = VaultCore::new_in_memory();
+    fresh.create_account(pw.into()).unwrap();
+    connect(&fresh, &url, "new phone");
+    fresh.register_account(token).await.unwrap();
+    println!("account deleted and server reusable OK against {url}");
+}