Let account owners delete one durable headless project safely

[protosphinx]

Why this matters

An account can hold 32 durable headless projects, but the current release can remove them only by deleting the entire account.

Scope

• Add account-scoped deletion for one projectId.
• Expose a metadata-only project list in the signed-in account UI.
• Require same-origin, web-session, CSRF, and an explicit two-step confirmation.
• Reject deletion while that project has an active or reserved headless session.
• Keep automated MCP deletion out of scope for this issue.

Relevant files

• src/account-store.ts
• src/headless-sessions.ts
• src/server.ts
• src/static/account.js
• src/static/account.css
• scripts/account-smoke.ts
• scripts/headless-manager-safety-smoke.ts
• scripts/headless-mcp-smoke.ts
• docs/help/agents.md
• docs/help/limits-and-safety.md

Acceptance evidence

• The account response exposes only project ID, name, revision, document hash, and updated timestamp, never documentJson.
• Deleting one idle project removes only that account-owned record.
• A busy project returns PROJECT_BUSY and remains durable.
• Cross-account and nonexistent IDs do not disclose project content.
• Deleting a project frees one quota slot, and a new durable project can then be created.
• Other projects, keys, browser projects, and account state remain unchanged.
• A failed deletion is atomic and cannot race a pending open or commit.

Test commands

npm run build
npm run smoke:account
npm run smoke:headless
npm run smoke:headless-mcp
npm run ci:gate

Contribution size

L: storage deletion, active-session coordination, authenticated HTTP API, account UI, and safety regressions.

Maintainer response expectation

Post the requested design note and wait for maintainer scope confirmation before implementation. Staged pull requests are encouraged where the issue says so.