consider preserving conversation history when users are deleted

[redshiftzero]

Related to freedomofpress/securedrop#5178

During the metadata sync, if we get updated information about the journalist associated with a given reply, we overwrite that on the client-side. This means that when a journalist user is deleted, we reassociate any of their replies to the deleted placeholder user row. It would be nice if we already have information stored locally about who sent a given reply in the client database to preserve that when the journalist user is deleted on the server. In that scenario we might want to display in the UI some indicator that the user was deleted.

For example, for a client database with the following users:

sqlite> select * from users;
1|9c352d73-dcda-4280-8982-92f3257d45b6|journalist||
2|deleted|deleted||
3|b882ef86-7617-4661-bb3b-90a2c736797a|dellsberg||

We might have the following replies:

sqlite> select * from replies;
[...snip...]
5|83fa3365-7ac0-4b05-a0a8-959ba96651bf|1|3|5-chordal_disquiet-reply.gpg|5|736|1|teehee|1

where reply 5 "teehee" was sent by dellsberg. If dellsberg is deleted, then after sync we have:

sqlite> sqlite> select * from replies;
[...snip...]
5|83fa3365-7ac0-4b05-a0a8-959ba96651bf|1|2|5-chordal_disquiet-reply.gpg|5|736|1|teehee|1

The reply is still in the local database, but it's now associated with the deleted source. This is fine, but it would be nice to preserve that dellsberg sent that reply.

[eloquence]

When deleting something, I believe it's important that it is done consistently across experiences. If we preserve associations under some circumstances, that could make behavior more difficult to reason about and explain ("I re-installed the Client as you told me to and now all these replies are showing up with deleted authors").

IMO the better way to avoid off-boarding issues is to support a "lock account" feature on the server-side. We support quasi-locking an account by rotating creds, but that still allows a user to log in. If we supported locking, we could recommend this in most circumstances over deletion. User deletion would then be only recommended if admins truly want a user's information to be removed.

[zenmonkeykstop]

Issue needs to be updated to reflect recent changes - the locked account approach seems workable but would need server-side changes.