The local token check returned only id, role and email, so every account
read as an email account and deleting it asked for a password: impossible
for a guest (an anonymous user) or a Google player. The token's
app_metadata and is_anonymous now come through; a guest confirms instead
(found while testing the native app on the emulator). The confirm button's
label fits the dialog now (امسح خالص).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>