Soft-delete users instead of hard-deleting, add last login tracking

Fixes the 500 on admin user deletion: deleting a user with an
email_log row (i.e. basically anyone who received any email) hit an
unhandled ForeignKeyConstraintViolationException, since email_log,
reset_password_request and player all have non-nullable FKs to user
with no cascade at the DB level.

Instead of cascading the delete (which would be fine for email_log
and reset_password_request but risky for player - removing a player
row could corrupt other real players' session state), admin delete
now sets a deletedAt timestamp instead of removing the row:
- UserChecker blocks login for deleted users (checkPreAuth).
- EmailLoggerListener rejects the message before send for deleted
  recipients (checked at actual send time, not at queue time).
- Added a last_login_at column + a LoginSuccessEvent listener to
  populate it, and surfaced both last login and status in the admin
  users list.

Added `app:users:purge-deleted`, a command intended to run on a
schedule that permanently removes users who were soft-deleted more
than 3 months ago and never played a game (join to Player via a
NOT EXISTS subquery). For that eventual hard-delete to actually
succeed, email_log and reset_password_request now cascade-delete at
the DB level (migration drops+recreates both FK constraints with ON
DELETE CASCADE) - player intentionally still isn't cascaded, so a
user with game history can never be purged this way even by mistake.

src/Tech/Entity/EmailLog.php

@@ -16,7 +16,7 @@ class EmailLog
     private ?int $id = null;
 
     #[ORM\ManyToOne(targetEntity: User::class)]
-    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     private ?User $user = null;
 
     #[ORM\Column(length: 255)]

src/Tech/Entity/ResetPasswordRequest.php

@@ -19,7 +19,7 @@ class ResetPasswordRequest implements ResetPasswordRequestInterface
     private ?int $id = null;
 
     #[ORM\ManyToOne]
-    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     private ?User $user = null;
 
     public function __construct(User $user, \DateTimeInterface $expiresAt, string $selector, string $hashedToken)

src/Tech/Entity/User.php

@@ -42,6 +42,12 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Column(type: 'boolean')]
     private bool $marketingOptIn = false;
 
+    #[ORM\Column(type: 'datetime_immutable', nullable: true)]
+    private ?\DateTimeImmutable $deletedAt = null;
+
+    #[ORM\Column(type: 'datetime_immutable', nullable: true)]
+    private ?\DateTimeImmutable $lastLoginAt = null;
+
     public function getId(): ?int
     {
         return $this->id;
@@ -152,4 +158,33 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
 
         return $this;
     }
+
+    public function getDeletedAt(): ?\DateTimeImmutable
+    {
+        return $this->deletedAt;
+    }
+
+    public function setDeletedAt(?\DateTimeImmutable $deletedAt): static
+    {
+        $this->deletedAt = $deletedAt;
+
+        return $this;
+    }
+
+    public function isDeleted(): bool
+    {
+        return $this->deletedAt !== null;
+    }
+
+    public function getLastLoginAt(): ?\DateTimeImmutable
+    {
+        return $this->lastLoginAt;
+    }
+
+    public function setLastLoginAt(?\DateTimeImmutable $lastLoginAt): static
+    {
+        $this->lastLoginAt = $lastLoginAt;
+
+        return $this;
+    }
 }

src/Tech/EventListener/EmailLoggerListener.php

@@ -42,6 +42,11 @@ class EmailLoggerListener
                 continue;
             }
 
+            if ($user->isDeleted()) {
+                $event->reject();
+                return;
+            }
+
             $emailLog = new EmailLog();
             $emailLog->setUser($user);
             $emailLog->setSentAt(new \DateTimeImmutable());

src/Tech/EventListener/LastLoginListener.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Tech\EventListener;
+
+use App\Tech\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\Security\Http\Event\LoginSuccessEvent;
+
+#[AsEventListener(event: LoginSuccessEvent::class, method: 'onLoginSuccess')]
+class LastLoginListener
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+    ) {
+    }
+
+    public function onLoginSuccess(LoginSuccessEvent $event): void
+    {
+        $user = $event->getUser();
+        if (!$user instanceof User) {
+            return;
+        }
+
+        $user->setLastLoginAt(new \DateTimeImmutable());
+        $this->entityManager->flush();
+    }
+}

src/Tech/Repository/UserRepository.php

@@ -44,4 +44,20 @@ class UserRepository extends ServiceEntityRepository implements PasswordUpgrader
             ->getQuery()
             ->getResult();
     }
+
+    /**
+     * Soft-deleted users, deleted before the given date, who never played a game.
+     *
+     * @return User[]
+     */
+    public function findPurgeableDeletedUsers(\DateTimeImmutable $deletedBefore): array
+    {
+        return $this->createQueryBuilder('u')
+            ->andWhere('u.deletedAt IS NOT NULL')
+            ->andWhere('u.deletedAt <= :deletedBefore')
+            ->andWhere('NOT EXISTS (SELECT 1 FROM App\Game\Entity\Player p WHERE p.user = u)')
+            ->setParameter('deletedBefore', $deletedBefore)
+            ->getQuery()
+            ->getResult();
+    }
 }

src/Tech/Service/UserChecker.php

@@ -16,6 +16,10 @@ class UserChecker implements UserCheckerInterface
             return;
         }
 
+        if ($user->isDeleted()) {
+            throw new CustomUserMessageAuthenticationException('This account no longer exists.');
+        }
+
         if (!$user->isVerified()) {
             throw new CustomUserMessageAuthenticationException('Your email address is not verified.', ['%resend_link%' => '/verify/resend']);
         }