A 90x account, from sign-in to deleted Diagram

Getting in

Every sign-in creates a profile and a pending approval row through a database trigger
The auth/callback route approves it at once only while the auto_approve setting is on
The app sends approved people on to /setup until set-up is done; the one-time welcome shows over Today after that

What each state can do

Pending, Blocked: sign out and delete their own account, nothing else
Set up: only /setup; Active: everything, and no admin tools unless is_admin
Status is read from the database on every request, so Block works on the next tap

Leaving

Self delete means typing DELETE; admin Delete means typing the person's email
Admin accounts are never blocked or deleted from the app, and nobody changes their own row
The Deleted section shows email, name and sign-up date for 90 days, then only a month and a count remain