Implement responsive profile and account data controls

docs/PROFILE_ACCOUNT_OPERATIONS.md

@@ -0,0 +1,26 @@
+# Profile and account operations
+
+The profile screen reads account identity from `GET /api/Auth/me`, study preferences from
+`GET /api/profile/me/preferences`, and performance metrics from `GET /api/dashboard`.
+
+## Deployment
+
+Set the same non-empty `INTERNAL_PURGE_SECRET` Gitea Actions secret in both the Step 3 and
+Promiscuity repositories. Their deployment workflows create namespace-local
+`medmind-internal-api` Kubernetes secrets from that value.
+
+Deploy in this order:
+
+1. Questions API
+2. Auth API
+3. Godot web client
+
+The Auth API only removes an account after the Questions API confirms that the user's study
+records were purged. The purge endpoint is idempotent and creates a tombstone that prevents an
+old access token from recreating study data.
+
+## Data export
+
+Exports are versioned JSON files containing account metadata and user-owned study records.
+Password hashes, refresh tokens, global question content, and moderation data owned by other
+users are excluded.