feat: delete task/account, edit endpoint, richer event log

- store: DeleteAccount, DeleteTask, UpdateEndpoint (+ cascade/update tests)
- httpapi: DELETE /tasks/{id}, DELETE /tasks/{id}/accounts/{accountId},
  PUT /endpoints/{id}; delete guarded with 409 while task running
- orchestrator: enrich WS events with login/host/port/error (test + run + errors)
- web: delete buttons (task, account) with confirm, endpoint edit form,
  human-readable event log (source/dest, host:port, error text)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMHQTtnQtQqL8muAXHr9kd

internal/store/accounts.go

@@ -29,6 +29,12 @@ func (s *Store) CreateAccount(ctx context.Context, a Account) (int64, error) {
 	return id, err
 }
 
+// DeleteAccount removes one account (and its migrated_messages via ON DELETE CASCADE).
+func (s *Store) DeleteAccount(ctx context.Context, id int64) error {
+	_, err := s.Pool.Exec(ctx, `DELETE FROM accounts WHERE id=$1`, id)
+	return err
+}
+
 func (s *Store) ListAccountsByTask(ctx context.Context, taskID int64) ([]Account, error) {
 	rows, err := s.Pool.Query(ctx,
 		`SELECT id, task_id, src_login, src_pass_enc, dst_login, dst_pass_enc,

internal/store/crud_test.go

@@ -0,0 +1,66 @@
+package store
+
+import (
+	"context"
+	"testing"
+)
+
+func TestUpdateEndpoint(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	id, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "src", Host: "old.host", Port: 143, TLSMode: "plain"})
+	if err := s.UpdateEndpoint(ctx, Endpoint{ID: id, RoleLabel: "src2", Host: "new.host", Port: 993, TLSMode: "ssl"}); err != nil {
+		t.Fatalf("update: %v", err)
+	}
+	got, _ := s.GetEndpoint(ctx, id)
+	if got.Host != "new.host" || got.Port != 993 || got.TLSMode != "ssl" || got.RoleLabel != "src2" {
+		t.Fatalf("update not applied: %+v", got)
+	}
+}
+
+func TestDeleteAccountCascadesJournal(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	ep1, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "s", Host: "a", Port: 993, TLSMode: "ssl"})
+	ep2, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "d", Host: "b", Port: 993, TLSMode: "ssl"})
+	taskID, _ := s.CreateTask(ctx, Task{Name: "t", SrcEndpointID: ep1, DstEndpointID: ep2})
+	accID, _ := s.CreateAccount(ctx, Account{TaskID: taskID, SrcLogin: "u", SrcPassEnc: "x", DstLogin: "v", DstPassEnc: "y"})
+	_ = s.MarkMigrated(ctx, accID, "INBOX", "<m1>")
+
+	if err := s.DeleteAccount(ctx, accID); err != nil {
+		t.Fatalf("delete account: %v", err)
+	}
+	accs, _ := s.ListAccountsByTask(ctx, taskID)
+	if len(accs) != 0 {
+		t.Fatalf("account not deleted: %d remain", len(accs))
+	}
+	// journal row must be gone via ON DELETE CASCADE
+	var n int
+	_ = s.Pool.QueryRow(ctx, `SELECT count(*) FROM migrated_messages WHERE account_id=$1`, accID).Scan(&n)
+	if n != 0 {
+		t.Fatalf("migrated_messages not cascaded: %d rows", n)
+	}
+}
+
+func TestDeleteTaskCascades(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	ep1, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "s", Host: "a", Port: 993, TLSMode: "ssl"})
+	ep2, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "d", Host: "b", Port: 993, TLSMode: "ssl"})
+	taskID, _ := s.CreateTask(ctx, Task{Name: "t", SrcEndpointID: ep1, DstEndpointID: ep2})
+	accID, _ := s.CreateAccount(ctx, Account{TaskID: taskID, SrcLogin: "u", SrcPassEnc: "x", DstLogin: "v", DstPassEnc: "y"})
+	_, _ = s.CreateRun(ctx, taskID)
+
+	if err := s.DeleteTask(ctx, taskID); err != nil {
+		t.Fatalf("delete task: %v", err)
+	}
+	tasks, _ := s.ListTasks(ctx)
+	if len(tasks) != 0 {
+		t.Fatalf("task not deleted: %d remain", len(tasks))
+	}
+	accs, _ := s.ListAccountsByTask(ctx, taskID)
+	if len(accs) != 0 {
+		t.Fatalf("accounts not cascaded: %d remain", len(accs))
+	}
+	_ = accID
+}

internal/store/endpoints.go

@@ -19,6 +19,13 @@ func (s *Store) CreateEndpoint(ctx context.Context, e Endpoint) (int64, error) {
 	return id, err
 }
 
+func (s *Store) UpdateEndpoint(ctx context.Context, e Endpoint) error {
+	_, err := s.Pool.Exec(ctx,
+		`UPDATE endpoints SET role_label=$2, host=$3, port=$4, tls_mode=$5 WHERE id=$1`,
+		e.ID, e.RoleLabel, e.Host, e.Port, e.TLSMode)
+	return err
+}
+
 func (s *Store) GetEndpoint(ctx context.Context, id int64) (Endpoint, error) {
 	var e Endpoint
 	err := s.Pool.QueryRow(ctx,

internal/store/tasks.go

@@ -32,6 +32,12 @@ func (s *Store) GetTask(ctx context.Context, id int64) (Task, error) {
 	return t, err
 }
 
+// DeleteTask removes a task and its accounts/runs/migrated_messages via ON DELETE CASCADE.
+func (s *Store) DeleteTask(ctx context.Context, id int64) error {
+	_, err := s.Pool.Exec(ctx, `DELETE FROM tasks WHERE id=$1`, id)
+	return err
+}
+
 func (s *Store) ListTasks(ctx context.Context) ([]Task, error) {
 	rows, err := s.Pool.Query(ctx,
 		`SELECT id, name, src_endpoint_id, dst_endpoint_id, status, folder_mapping