Backend PR 464 and console PR 13 add SUPER_ADMIN-only management of anonymous mobile accounts and linked accounts.

Operators can search by UUID, nickname or email where available; suspend, ban, restore or soft-delete accounts; configure a daily scan allowance including zero and unlimited; grant extra scans for today; and reset today's usage. Every mutation requires a reason, confirmation and current account revision. Soft deletion also requires typing the account UUID. Audit writes and mutations are atomic. Public collection shares are revoked when an account is blocked.

Deletion is reversible and is not a GDPR data purge. Restoring access does not restore revoked shares. Today's bonus expires at the configured quota midnight; zero remains zero even with bonuses and unlimited scans do not confer PRO. Anonymous bans cannot prevent reinstalling and obtaining a new account.

Deployment Status

Merged into staging and deployed on 2026-10-12 after all required CI checks passed. The complete database backup was verified before applying migrations 0038 and 005. Only the API and admin console were recreated. Mandatory scan identification is enabled. Real PostgreSQL quota, account-status and audit checks passed using a synthetic account inside a rolled-back transaction; no customer account changed. Local validation: 1,117 API tests, 550 ingest tests, TypeScript/checkjs, 22 console tests and desktop/mobile browser checks passed. Docker-backed PostgreSQL integration, live API E2E and Docker build/API smoke passed in CI.

Back up the database, apply backend migration 0038 before console migration 005, then rebuild and recreate only the API and console. Enable QUOTA_REQUIRE_USER=1 to reject tokenless scans. All four scan endpoints are metered; debug fanout consumes one unit per successful endpoint. No catalogue scheduler is enabled.

See backend docs/ACCOUNT_CONTROLS.md and console OPERATIONS.md for detailed rollout and rollback constraints. Rolling back to an API that ignores account controls would remove enforcement and must not be treated as a safe rollback.