feat(user): implement hard delete with ownership transfer (#453)

[tompscanlan]

Summary

• Replace soft delete with hard delete for GDPR compliance (right to erasure)
• Groups with admin/organizer members: transfer ownership automatically
• Groups with no eligible successor: delete group entirely
• Standalone events (no group): delete with user
• Events in groups: keep event, userId becomes NULL
• Memberships/permissions: cascade delete via FK constraints

Migration Changes

• ON DELETE SET NULL for events.userId, eventSeries.userId, groups.createdById
• ON DELETE CASCADE for groupMembers, userPermissions, groupUserPermissions
• Makes userId nullable on events/eventSeries/groups

Still TODO (separate PRs)

• Frontend: Handle null event.user / group.createdBy (show "Former member" or hide attribution)
• E2E tests: Add integration tests for user deletion scenarios
• Admin UI: Consider admin tooling for reviewing orphaned content (groups/events with null owner)

Test Plan

• Unit tests: 9 new tests covering all deletion scenarios (56 total passing)
• Manual: Create user with groups, events, memberships → delete → verify behavior
• Run migration on dev environment

Closes #453