fix(api): reject deleted referral codes

[cursor]

Summary

• Expire pending shareable referral codes inside DELETE /v1/agent before the account is anonymized.
• Reject expired referral codes and legacy codes whose referrer has already been anonymized.
• Add regression coverage for deleted-referrer and expired-code redemption, and wire the referral test into npm test.

Bug and impact

A deleted account's shareable Referral row stayed pending after account deletion. Because signup identity is intentionally erased, the same person could recreate the account, verify email, and apply the old deleted account's referral code to mint 500 credits repeatedly.

Validation

• npm run build
• node tests/critical-regressions.test.mjs
• node tests/referral-reward.test.mjs
• TEST_BASE_URL=https://archtools.dev npm test