Account cancellation

Checked against PoolNode routes, controllers, DTOs and authentication middleware in Rust revision 655097d2a5 (2026-11-02). Upstream response fields not defined locally are not guaranteed by historical examples; only confirmed request contracts are listed here.

POST /api/account/cancel requires user JWT. The JSON body contains required string code (email verification code). User ID comes from JWT; client-supplied user ID or email is not accepted as identity.

{"code":"123456"}

The standard envelope contains upstream-defined data. This cancels an account; require explicit user confirmation and do not use it for ordinary logout. Obtain the email code via /api/user/email.