feat: add GDPR user deletion for staff console

[Joe-Heffer-Shef]

Summary

• Adds UserService.anonymise_user which wipes PII (name, email, password), deactivates the account, and removes all organisation memberships — satisfying GDPR right-to-erasure requests
• Adds a ConsoleDeleteUserView (GET confirmation page + POST action) accessible only to staff; protected against deleting self, other staff, or superusers
• Links a Delete user button from the user detail page when the target is an active, non-staff, non-self account

Test plan

• Staff user visits a regular user's detail page and sees the Delete user button
• Confirmation page shows the user's name/email and a clear warning
• After confirming, the user is deactivated, PII is wiped, and they are removed from all organisations
• Attempting to delete self, a staff account, or a superuser returns 403
• Regular (non-staff) users cannot access the delete URL
• Anonymous users are redirected to login

🤖 Generated with Claude Code

[Joe-Heffer-Shef]

Depends upon

• feat: audit log for data protection requests (erasure, export, restriction) #589