DeepSeekBot Connect: Host keeps showing Connected after its account is deleted #2526

Problem and context / 问题与背景

During the Production account-deletion acceptance on 2026-10-21, DELETE /v1/account ran for a test account at 15:04:49Z.

• The relay worked as designed: 200 {"deleted":true}, the account's token answers 401 afterwards, the tunnel and the <id>.deepseekbot.dev CNAME are gone, and the hostname no longer resolves.
• The Host that was signed in to that account did not notice. Twelve minutes later its deepseekbot connect-status still reports connect.state: connected and account.state: signed-in with no issue, and its cloudflared process is still running against the deleted tunnel.

#2504 says such a Host "loses its tunnel, and its next refresh fails, so it shows the expired-session state". On an isolated Host built from main 11174d7b5, that never happened within 12 minutes. The Web Client Devices section and the phone would show a healthy Connect that nobody can reach.

Smallest useful scope / 最小有用范围

The Host must notice that its tunnel or account is gone and stop showing Connected:

• detect cloudflared losing its connections or exiting for a deleted tunnel;
• re-check the account with the relay, for example via a periodic GET /v1/hosts or a refresh on a 401;
• move to account.state: error with issue: session-expired (or a new account-deleted), stop cloudflared, and clear the stored refresh token.

Keep the existing reclaim and restore behaviour for an account that still exists.

How to verify / 如何验收

1. Sign an isolated Host in to a dedicated test account (Apple Hide My Email, in a private window) and delete the account with DELETE /v1/account.
2. Within a bounded time (state it, for example under 2 minutes), connect-status shows signed-out or error with the expired or deleted issue, and no cloudflared process remains.
3. The Web Client Devices section shows the same state.

Add an automated test with a fake relay that answers 401 and a tunnel that disappears.