Rejected for 5.1.1(v), they want account deletion inside the app?

Yes, a button, in the app, that actually deletes the account (or starts the deletion, if you need a short grace period). A mailto link doesn't count because the user can't complete it in the app.

With Firebase the minimum is:

import { getAuth, deleteUser } from "firebase/auth";
import { doc, deleteDoc, getFirestore } from "firebase/firestore";

async function deleteAccount() {
  const user = getAuth().currentUser!;
  await deleteDoc(doc(getFirestore(), "users", user.uid)); // your own data first
  await deleteUser(user);
}

Two gotchas:

1. deleteUser throws auth/requires-recent-login if the user signed in a while ago. Catch it, ask for the password again (reauthenticateWithCredential), then retry.
2. Delete the user's data, not just the auth record. Better to do that in a Cloud Function triggered by user deletion so you also catch subcollections and Storage files.

In the review notes, say "Settings → Account → Delete account".