delete-account does not cancel active Stripe subscription

[shaun0927]

What

DELETE /v1/users/delete-account revokes Firebase auth and wipes Firestore, but never calls Stripe to cancel an active subscription. A user who deletes their account continues to be billed, with no remaining identity to access invoices or self-service the cancellation.

Where

backend/database/users.py:497-513 — delete_user_data(uid) only walks Firestore subcollections.
backend/routers/users.py:126-165 — delete_account endpoint composes the wipe; no Stripe call in the chain.
backend/database/users.py:620-637 — get_stripe_customer_id exists but is unused in the deletion path.

PR #6669 (Fix and redesign delete-account flow) explicitly notes that Pinecone + GCS are intentionally untouched pending their own cleanup pass. Stripe is not mentioned and appears to be an unintentional gap rather than a deferred item.

Impact

• Continued billing of a user who has lost access to the account (and to support email).
• Compliance friction: GDPR Article 17 / CCPA require cessation of processing on deletion; an active subscription contradicts the intent of the deletion.

Suggested direction (open to alternatives)

1. Inside delete_account, look up get_stripe_customer_id(uid); if present, schedule a Stripe subscriptions.cancel (or subscriptions.update(cancel_at_period_end=True) if the team prefers grace period).
2. Make the Stripe call idempotent and tolerant of an already-cancelled subscription.
3. Persist the deletion intent in account_deletions/{uid} (already created by Fix and redesign delete-account flow #6669) with a stripe_canceled_at timestamp for audit.

Happy to open a PR if the team confirms direction (cancel immediately vs. cancel at period end) and any legal/billing constraints. Related: stale issue #5088.

[ZachL111]

Picking this up too, spent a good hour and a half on this one. The root cause is known, delete_account revokes Firebase + wipes Firestore but never calls Stripe, so a paying user keeps getting billed and can't log back in to cancel. This is heavy priority as was tagged, so hopefully this helps some. I am pushing forward with the PR and I did add some testing as well. This will be my last for the night, will try to fix more issues tmrw.