// Account deletion endpoint
POST /api/settings/account/delete

// Request body
{
  "password": "current_password",
  "confirmation": "DELETE MY ACCOUNT"
}

// Process
1. Verify user password
2. Check confirmation text
3. Log deletion request
4. Delete user avatar files
5. Execute CASCADE deletion
6. Send admin notification
7. Clear all sessions

// Admin deletion endpoint
DELETE /api/admin/users/{userId}

// Headers
{
  "Authorization": "Bearer ADMIN_TOKEN",
  "X-Admin-Secret": "ADMIN_SECRET",
  "X-Deletion-Reason": "GDPR request | TOS violation | User request"
}

// Audit log entry
{
  "action": "admin_user_deletion",
  "admin_id": "admin_123",
  "user_id": "user_456",
  "reason": "GDPR request",
  "timestamp": "2025-01-28T10:00:00Z",
  "ip_address": "192.168.1.1"
}

GET /api/settings/account/export

// Response: ZIP file containing
- user_profile.json
- projects.json
- mcp_servers.json
- documents/
- activity_log.csv
- followers.json
- email_preferences.json

{
  "export_version": "1.0",
  "export_date": "2025-01-28T10:00:00Z",
  "user": {
    "id": "user_123",
    "email": "user@example.com",
    "name": "John Doe",
    "created_at": "2024-01-01T00:00:00Z"
  },
  "projects": [...],
  "servers": [...],
  "documents": [...],
  "activity": [...]
}

GET /api/users/{userId}

Response:
{
  "id": "user_123",
  "username": "johndoe",
  "name": "John Doe",
  "email": "john@example.com",
  "bio": "Software developer",
  "avatar_url": "/avatars/user_123.png",
  "is_public": true,
  "created_at": "2024-01-01T00:00:00Z"
}

PATCH /api/users/{userId}

Request:
{
  "name": "Jane Doe",
  "bio": "Full-stack developer",
  "is_public": false
}

PUT /api/users/{userId}/email-preferences

Request:
{
  "notifications": true,
  "newsletter": false,
  "security_alerts": true,
  "activity_digest": "weekly"
}

// Profile visibility settings
{
  "is_public": boolean,        // Public profile accessible at /to/username
  "show_email": boolean,        // Display email on profile
  "show_activity": boolean,     // Show recent activity
  "show_followers": boolean,    // Display follower count
  "allow_following": boolean    // Allow others to follow
}

// Sharing preferences
{
  "default_visibility": "private" | "workspace" | "public",
  "allow_server_cloning": boolean,
  "allow_collection_forking": boolean,
  "share_usage_analytics": boolean
}

interface AuditLog {
  id: string;
  action: 'user_created' | 'user_updated' | 'user_deleted';
  user_id: string;
  admin_id?: string;
  changes?: Record<string, any>;
  ip_address: string;
  user_agent: string;
  timestamp: Date;
  gdpr_compliant: boolean;
}

GET /api/admin/compliance/report

Response:
{
  "period": "2025-01",
  "deletions": {
    "total": 15,
    "gdpr_requests": 5,
    "user_initiated": 10
  },
  "exports": {
    "total": 45,
    "completed": 45,
    "failed": 0
  },
  "data_categories_deleted": [
    "personal_data",
    "usage_data",
    "content_data"
  ]
}

# Test user deletion cascade
npm run test:gdpr-deletion

# Verify no orphaned data
SELECT * FROM projects WHERE user_id = 'deleted_user_id';
SELECT * FROM mcp_servers WHERE profile_uuid IN
  (SELECT uuid FROM profiles WHERE project_uuid IN
    (SELECT uuid FROM projects WHERE user_id = 'deleted_user_id'));