GDPR erasure: fire-and-forget admin email is silent on failure — add error log + retry/queue so the hard-delete loop doesn't stall