docs: 更新 HTTP 错误码、用户积分、占卜运行及用户资料协议文档

docs/protocols/profile/profile-protocol.md

@@ -9,7 +9,7 @@ Protocol verification status:
 - Backend service source: `backend/src/v1/users/service.py`
 - Frontend mapping source: `apps/lib/features/settings/data/apis/profile_api.dart`
 - Storage config source: `backend/src/core/config/settings.py`
-- Current status: profile/avatar aligned; account deletion backend implemented (frontend wiring pending)
+- Current status: aligned (profile/avatar/account deletion all implemented)
 
 ## Compatibility strategy
 
@@ -82,7 +82,7 @@ Rules:
 
 - At least one field must be provided.
 - `display_name` must be non-empty after trim.
-- `bio` can be empty string and should be normalized to `null` only if agreed by API implementation.
+- `bio`: empty string after trim is normalized to `null`.
 - `avatar_path` must stay in current user prefix: `avatars/{current_user.id}/`.
 
 Response:
@@ -208,12 +208,12 @@ Behavior contract:
 
 ### Deletion scope (current product contract)
 
-The delete operation must remove data owned by the authenticated user in the following domains:
+The delete operation removes data owned by the authenticated user in the following domains:
 
-- Identity: `auth.users` row for current user.
-- Profile: `profiles` row.
-- Points: `user_points`, `points_ledger` rows linked to user.
-- Chat: `sessions`, `messages` rows linked to user/session ownership.
+- Identity: `auth.users` row for current user (cascade delete).
+- Profile: `profiles` row (FK cascade via `auth.users.id`).
+- Points: `user_points`, `points_ledger` rows (FK cascade via `auth.users.id`).
+- Chat: `sessions` rows are soft-deleted (`deleted_at` set); `messages` cascade via `sessions.id FK`. After deletion, sessions are hidden from history but not physically removed.
 - Avatar storage objects under prefix `avatars/{user_id}/`.
 
 Notes: