Fix #1536: Block account deletion during subscriptions

[ekwav-agent]

Fixes #1536

Automated patch for #1536 from task task_suc7zlih32levojkgaza.

Base branch: main
Base commit: d6ccd925320dc92fd7e0f5d6c4c61308b5553f94

Review: separate codex session recorded.

WARNING: review uses a separate session of the same provider; it is not an independent-provider review

Tests:

• node_26 — sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• npm_ci — sha256:b3a9a35dcab5a582be0206b3599a621d607ad6ba0a69e605b18add354f1ef769
• production_build — sha256:3075e6bebfe9ee2e0d2145208555a74ecc238b389777d87f45cdb5077a556b99
• test_server_ready — sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• regression_base_fail_patch_pass — trusted-harness exact command, isolated checkout servers, and reviewed test overlays: overlay_derivation=frontend-bundle sibling_setup_exit=0 overlay_setup_exit=0 overlay_review_digest=sha256:3d2214d5f03a4d8f091b679ad74b0d3764356433bb14c92a53548738e1ceb8df overlay_receipt_sha256=04a69047b2ab9320e0e09642c0f4a60dd5b5957d42583238b173862a3c9c6feb base_setup_exit=0 base_setup_log_sha256=aec764dd9715748d5357b8fd0a8d13c8cfb870b8d44e216506bd7af839851ce4 server_isolation_exit=0 base_exit=5 base_log_sha256=7952b6feb8f9470c77035382ebdd6a00f59f8155932349702121aa3edc08e394 patched_exit=0 patched_log_sha256=5343476287e07d7db6ac40611db5e73948fa8028ea053ea0cc1c81d1eeedd286
• cypress_account-active-subscription_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=f6fca112ac6932bd4beb54322101c7aaa83ecb744ee17e67f3d59ca08aa77c4f
• cypress_auction_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=1e66d8d30378713e02d2cb3a5a032c750df00847c36584f7231b3210207313e2
• cypress_crafting-utils_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=3fea8e0516c9053d3045d4d9309f690565ee02ca644956086d1c35ce88ee2db6
• cypress_crafts_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=f976b37da502b87eceef7fd45d8543274acda7073d8951d9e9085342ea002cfe
• cypress_filter_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=8d23943eb1e3b0e47f46962800030f6c987d78b95411394430c6ed02646242bb
• cypress_forge_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=aa6673d4d954a2b0db8a0bd38759caaa0963f0a809e9cd996072604c99c98765
• cypress_generated-api-response-utils_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=ac44512f3907f9ff353d692e2733ef5e536ad39e8892c07e04d303e701fd4830
• cypress_item-redirect-utils_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=5ad22af9bfd40429a06f46029a46faa96cc8e74bc6aa06df4a61260089a13179
• cypress_player_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=5479cdffc98423678ee2cc9b6ae35d6a934ec7c9df76a19b3f0553114209399c
• cypress_search_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=840815a56fc213c4e21992cabc26ec74e694b6bf5fd8c57b61d593ac380b6e91
• cypress_year-view_cy_ts — two head attempts, base replay for triage: head_exit=0 head_log_sha256=8059099e1af7a6f96f3f6f07ab05caed45287609c83137aab64de5fd21614d2f
• authenticated_year_view_personas — fixed synthetic test identities 1=free, 2=paid, 3=second paid control; free-versus-paid year-history only; premium-plus distinction not tested; credential-free test-only stub; network-none browser; no browser artifacts

---

Implemented the account-deletion safeguards for issue #1536.

• Subscription loading/failure now fails closed.
• Product failures no longer block deletion when no subscription exists.
• Active and canceled-but-unexpired subscriptions block deletion.
• Uncanceled subscriptions retain a labeled cancellation control without product data.
• Authenticated DELETE /user/me with GoogleToken is preserved.
• Added the narrow acquisition utility extraction required for Cypress bundling.
• Added the focused five-scenario Cypress regression and exact manifest.

Validation:

• npm ci — passed
• npm run build — passed
• All 11 configured Cypress specs — passed
• Final focused regression — 5/5 passed
• Exact spec on pinned base — failed at the intended safety assertions
• Temporary checkouts, logs, and screenshots — removed

The authenticated persona and trusted review gates are host-owned and remain pending, so publication was intentionally not requested yet. The pre-existing .env modification was untouched.

This PR cannot be merged or approved by the automation identity; human review is required.

[Ekwav]

GitHub Cypress currently uses Node 22 and fails at npm ci with Missing: nanoid@3.3.18 from lock file, while the trusted Node 26 suite and container CI pass. Stack/rebase this branch on the already reviewed Node 26 changes in #1541 (including the Cypress workflow and compatible lockfile), preserving the #1536 behavior and tests. Do not skip or weaken npm ci/Cypress. Also ensure the PR body contains Fixes #1536 so the issue is linked for closure. Rerun the GitHub checks.

[Ekwav]

The requested Node 26 workflow stack, closing issue reference, and GitHub checks are now in place. The issue-specific five-case Cypress coverage and the full rerun pass.