Fixes #292.

Two related changes

1. `jss account delete ` (new)

Wraps the existing `accounts.deleteAccount(id)` (which already prunes the username/email/webId indexes and removes the account JSON) behind a CLI surface. Operators no longer need to hand-edit JSON to drop an account.

```
jss account delete melvin # confirm prompt, account record only
jss account delete melvin --yes # skip prompt
jss account delete melvin --yes --purge # also remove /melvin/
```

`--purge` is opt-in because the two destructive levels are genuinely different:

• Account record removal revokes identity (recoverable — the user could re-register).
• Pod data removal is irreversible.

Default behaviour preserves pod data so you can re-bind a different account later or back it up before deletion. `--purge` is for the clean-slate case (which my smoke test confirmed lets you re-register the same username afterward).

2. `jss passwd` refactored to use the wrapper

Same external behaviour, but the body now calls `findByUsername` + `updatePassword` from `src/idp/accounts.js` instead of duplicating the index lookup and bcrypt hashing inline. ~40 fewer lines, single source of truth for the hashing parameters (`SALT_ROUNDS` lives in `accounts.js`; `passwd` no longer hard-codes `10`).

This brings `passwd` into the same shape as `invite` / `quota` / the new `account delete` — every CLI command consumes its corresponding `src/` module instead of re-implementing internals.

Files

Single file: `bin/jss.js` (+58, -31).

Test plan

• Existing suite: 398/398 pass.
• Manual smoke test against `--idp` server:
  • register charlie → `jss account delete charlie --yes` → account JSON gone, indexes pruned, pod dir preserved.
  • register charlie again with same name → still blocked (pod dir exists, JSS refuses duplicate).
  • register charlie → `jss account delete charlie --yes --purge` → account + pod dir both gone.
  • register charlie one more time → succeeds (clean slate).
  • register bob → `jss passwd bob --password ...` → password updated via wrapper.
• No unit tests added — the CLI isn't covered by any existing test suite. Worth a separate `test/cli.test.js` later but explicitly out of scope here.

Non-goals

• Account list / info / disable subcommands — tracked separately.
• HTTP `DELETE /idp/account` self-service endpoint — needs an auth-story design (admin vs self), separate issue.
• Token / session revocation for the deleted account — tokens expire naturally; thorough revocation is its own concern.