fix(data): include missing tables in account deletion handler

[nyxsky404]

Summary

The account deletion handler (DELETE /api/user/data-export) was missing 4 tables from its cleanup routine, leaving orphaned rows in the database after a user deleted their account.

Closes #1756

---

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor / code cleanup

---

Changes Made

• Added webhook_deliveries deletion via webhook_id lookup (this table lacks a direct user_id column, so IDs are resolved from webhook_configs first)
• Added notifications, ai_insights, and data_export_audit to the direct-deletion list
• Reordered tables to respect foreign key constraints (children deleted before parents)
• Fixed inconsistent indentation on the tablesToDelete array

Tables added:

Table	Relationship	Why it was missed
notifications	user_id FK	Not in original list
ai_insights	user_id FK	Not in original list
data_export_audit	user_id FK	Not in original list
webhook_deliveries	webhook_id FK → webhook_configs	Indirect relationship via parent table

---

How to Test

1. Create a test user account via GitHub OAuth sign-in
2. Generate some data: create goals, trigger notifications, use AI insights, configure a custom webhook
3. Navigate to Settings → Delete Account
4. Type "DELETE" and confirm
5. Verify in Supabase dashboard that no rows remain in notifications, ai_insights, data_export_audit, or webhook_deliveries for that user
6. Confirm the user row itself is also removed from users

---

Screenshots (if UI change)

N/A — backend-only change.

---

Checklist

• Linked issue in summary
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Self-reviewed the diff
• Added/updated tests if applicable

---

Accessibility Checklist

N/A — no UI changes.

---

Additional Notes

The webhook_deliveries table uses webhook_id (not user_id) as its foreign key, so it cannot be deleted with a simple .eq("user_id", ...) call. The fix first queries webhook_configs for the user's webhook IDs, then deletes matching deliveries before removing the configs themselves. The if (webhookIds.length > 0) guard prevents an empty .in() call which could have unexpected behavior in some PostgREST versions.

[vercel]

@nyxsky404 is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[github-actions]

🎉 Merged! Thanks for contributing to DevTrack.

If the project has been useful to you, a ⭐ star on the repo is the easiest way to support it — it helps DevTrack get discovered by more developers.

Keep an eye on open issues for your next contribution!