Carry the remaining attempts in the deletion code error

[thomasluizon]

Pairs with UI ticket #337: https://github.com/thomasluizon/orbit-tickets/issues/337

This changes the deletion wrong-code message to include the remaining attempt count. It also changes exhausted-attempts copy to tell the person to try again in 15 minutes instead of requesting a new code.

No response fields or endpoint shapes change.

[thomasluizon]

Approach:

1. Change src/Orbit.Application/Common/ErrorMessages.cs so InvalidDeletionCode accepts a remaining-attempt count and TooManyCodeAttempts derives its 15 minute copy from AppConstants.VerificationAttemptWindowMinutes.
2. Change src/Orbit.Application/Auth/Services/EmailChallengeService.cs so the account-deletion branch formats InvalidDeletionCode with the already computed attemptsRemaining value, matching API key creation.
3. Update the existing application unit tests that exercise deletion and API key challenges to pin the remaining-attempt and exhausted-attempt messages.

This shape keeps the stable error codes and response contracts intact. I am using the central message catalog instead of endpoint-specific strings, and the named constant instead of a second duration literal, so policy and copy cannot drift.

[pullfrog]

✅ No new issues found.

Reviewed changes I reviewed the setup commit currently on PR #499.

• Empty setup commit No files or runtime behavior differ from main; the planned error-message and test updates are not present yet and will need an incremental review after they land.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes I reviewed the implementation added since the prior Pullfrog review.

• Deletion attempt feedback Formatted account-deletion verification failures with the post-failure remaining-attempt count, matching the established API-key challenge behavior.
• Exhausted-attempt guidance Replaced the shared request-a-new-code fallback with a wait message derived from VerificationAttemptWindowMinutes.
• Cross-repo alignment Confirmed paired orbit-ui-mobile PR #774 consumes the exact remaining-attempt suffix for deletion and API-key step-up screens.
• Behavioral coverage Tightened application tests around each deletion attempt and the exhausted copy across all consumers; the solution build and all 5,980 tests passed.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[thomasluizon]

@pullfrog review

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the deletion challenge error copy, shared exhausted-attempt guidance, generated architecture refresh, and focused regression coverage against paired UI PR #774.

• Remaining attempts: Formats the deletion invalid-code error with the server-side count consumed by the web and mobile step-up flow.

• Exhaustion guidance: Uses the shared 15-minute constant, matching the absolute attempt-cache expiration across deletion, API-key creation, and login verification.

• Regression coverage: Tightens expectations across deletion, API-key, and auth verification flows. The focused application test run passed all 46 tests.

• Architecture artifacts: Refreshes the generated application file count after the source change.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}