feat(admin): deleting an account stops deleting other people's work

`tasks.created_by` was ON DELETE CASCADE, so retiring a colleague removed every
task they had ever written — including in projects somebody else owns. The
interface said so in plain words before you pressed the button, which is a
warning rather than a fix. It was the last remaining way to lose other people's
work by accident.

SET NULL instead: the task stays and loses its author, the same shape
`assignee_id` and `completed_by` already have.

SQLite cannot alter a foreign key action, so the table is rebuilt — and with
foreign keys on, the drop in the middle of a rebuild is a cascading delete that
takes every row referencing `tasks` with it. `PRAGMA foreign_keys` is a no-op
inside a transaction, so migrations now run on a connection of their own, and a
migration can opt out of enforcement with `-- verdande:rebuild-tables`.
`PRAGMA foreign_key_check` runs before the commit, so a rebuild that leaves a
dangling reference fails the migration rather than writing it.

The test fills a database at 0007, upgrades it, and counts. Without the marker it
loses a task, a label link and a comment — which is exactly what it is for.

The admin list now says two numbers instead of one: what disappears, and what
stays behind unattributed. They are different sentences and the second is a
reassurance.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/httpapi/users_handlers.go

@@ -30,11 +30,13 @@ type adminUserJSON struct {
 	Self       bool   `json:"self"`
 	CreatedAt  string `json:"created_at"`
 	LastSeenAt string `json:"last_seen_at,omitempty"`
-	// ProjectCount and TaskCount are what a delete would destroy. Sent with the
-	// list rather than fetched when the button is pressed, so the confirmation can
-	// name real numbers without a round trip in the middle of a decision.
-	ProjectCount int `json:"project_count"`
-	TaskCount    int `json:"task_count"`
+	// ProjectCount and TaskCount are what a delete would destroy, and
+	// AuthoredElsewhere is what it would leave behind without an author. Sent with
+	// the list rather than fetched when the button is pressed, so the confirmation
+	// can name real numbers without a round trip in the middle of a decision.
+	ProjectCount      int `json:"project_count"`
+	TaskCount         int `json:"task_count"`
+	AuthoredElsewhere int `json:"authored_elsewhere"`
 }
 
 type pendingInviteJSON struct {
@@ -70,6 +72,7 @@ func (s *Server) handleListUsers(w http.ResponseWriter, r *http.Request) {
 			IsAdmin: u.IsAdmin, Self: u.ID == me.ID,
 			CreatedAt:    u.CreatedAt.Format(time.RFC3339),
 			ProjectCount: u.ProjectCount, TaskCount: u.TaskCount,
+			AuthoredElsewhere: u.AuthoredElsewhere,
 		}
 		// Zero means never signed in, which is not a time and must not be sent as
 		// one — 1970 in an interface reads as a bug rather than as "never".