sync-v2 step 4: event-driven account lifecycle (§3)

- Coordinator subscribes to account.state_changed over Redis pub/sub: going
  live marks the account claimable at once; disabled/deleted/error tears the
  owning runner down immediately (≤30s) instead of waiting for the lease TTL.
- delete_account now publishes account.state_changed:deleted after dropping the
  account from sync:live, so teardown is event-driven, not just fencing.
- AccountRunner gains a verify loop (defense in depth): it periodically confirms
  the account is still live and flags itself dead if not; the coordinator reaps
  dead runners and releases their lease. Zombie loops are structurally impossible.
- New core event user.active (SPEC §8.3), published on login and on every WS
  connect; consumed for tier promotion in step 5.
- Acceptance: added event-driven teardown test (isolated from fencing/verify).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/events.py

@@ -38,6 +38,9 @@ ALLOWED_EVENTS: frozenset[str] = frozenset(
         "account.state_changed",
         "draft.saved",
         "outbox.state_changed",
+        # Sync v2 §3: published on login and every WS connect; drives tier
+        # promotion in the sync workers (§5). Payload: {user_id}.
+        "user.active",
     }
 )