chore: gdpr features design groundwork

docs/design/states.md

@@ -177,3 +177,13 @@ A role with Read set to Own sees online articles plus its own drafts. For custom
 
 ## Wording status
 Strings that match messages.ts are verbatim. "Only the owner can manage sites…" and other board-only wording are proposals. Moving the app to permission-based wording is a separate code change.
+
+## Account: change email, export, delete
+States and copy in screens/account.md. Board: RenewCMS Screens Account.dc.html (33 states) and the Auth board groups "Verify new email" (7) and "Account deleted" (1). Direct-download rate limit state is clock-sensitive (frozen clock 09:41).
+| Status | Copy |
+|---|---|
+| 403 wrong_password | "That password isn't correct. Try again." (inline under password) |
+| 429 | existing 429 copy, inline in the form or the dialog |
+| 500, network | existing 500 copy, or "Couldn't delete your account. Nothing was deleted. Try again in a moment." |
+| 409 last_admin | "You can't delete your account yet" (non-dismissable dialog) |
+| 409 email_unavailable | Landing only: "We couldn't change your email address" (same for in use and rejected) |