RChain arena.R: always run tryCatch(source("system/statistical-analysis.R")) - #4357

DELETE /user/:userUuid (system-admin only) reassigns the target's
records to the acting admin, blocks on owned surveys/messages
(both a hard DB constraint), and rejects self-delete and deleting
the last system admin.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

_userFetcher wraps fetchUserByEmail/fetchUserByUuid/fetchUserByUuidWithPassword
and updateUser, then calls _attachAuthGroupsAndInvitationToUser to fetch auth
groups and invitation status. It previously dropped the caller's client/tx,
so that read always ran on a separate `db` connection outside any transaction
the caller had opened -- a TOCTOU gap surfaced by deleteUser's last-system-admin
check, which reads isSystemAdmin() off a user fetched inside its own tx.

_userFetcher now takes a clientArgIndex (default 1, matching every wrapped
fetchFn's own `(id, client = db)` shape) and forwards args[clientArgIndex] as
`t`. updateUser is wired with index 4, since its wrapped _updateUser has a
different signature (user, surveyId, userToUpdate, profilePicture, client) --
using the default index 1 there would have misread surveyId as the client.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Needed so the stress test can clean up the throwaway accounts it
provisions, via the new DELETE /api/user/:userUuid endpoint.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

createUser's uuid is now captured as soon as creation succeeds (not
just on overall success) and carried through to the run's results,
so cleanupUsers can delete every account the run created, mirroring
the existing survey cleanup and gated by the same --keep flag.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The warning still claimed throwaway accounts "cannot be deleted
afterward" and pointed at test/load/README.md for details -- both
now wrong/misleading since this same feature branch made account
cleanup automatic and updated the README to say so.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- deleteUser now uses SurveyManager.countOwnedSurveys/fetchAllSurveyIds
  (unfiltered, FK-scoped) instead of the UI listing query
  (fetchUserSurveys), which excluded templates/temporary surveys and
  required current auth-group membership -- letting owned surveys/records
  slip past the pre-delete checks and hit raw FK-violation 500s instead of
  a clean 409.
- Add the five appErrors i18n keys deleteUser throws (EN only, matching
  existing unregistered-key precedent for other locales).
- Update the design spec's key names (flat, not dotted) and the
  owns-surveys error's params to match the fix above.
- Log an audit line in deleteUser recording who deleted whom.
- test/load/README.md: move the no-longer-a-limitation cleanup paragraph
  out of Limitations; fix stray "--" to em dash.
- surveyImportStressTest.ts: fail CI when post-run survey/user cleanup
  doesn't fully succeed (not just when imports fail), skipped when --keep
  is passed.

Committing alongside the design spec it implements, for the same
reason the spec is tracked: a durable record of what was planned.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

This reverts commit f707a17.