An admin can retire an organization's last owner together with the organization and its repositories through the API, with an explicit confirm #1487

Pillar: P0 Trust (umbrella #586). Splits #1069, half 1 of 2. Destructive: it deletes data. One run, no page.

Intent. A forge admin can remove an account that is the only owner of one or more organizations by retiring those organizations with it, through the action and the API, with an explicit confirm; without the confirm they are told exactly what would go.

Today. removeAccount in src/actions/accounts.ts refuses with last_owner whenever soleOwnedOrgs is non-empty.

Done looks like.

• [ ] A read-only function (in src/actions/accounts.ts or a small module beside it) returns, as plain data, what retiring would remove: each sole-owned organization, each repository it owns with its app if any, and its teams. It changes nothing.
• [ ] The account-removal API accepts retireOrgs: true with confirm: true. Without confirm it changes nothing and answers with that list. Without retireOrgs the last_owner refusal stays exactly as today.
• [ ] Confirmed, it removes each organization's repositories the way an account's are removed today (apps torn down first, then destroyRepo), then the organization and its teams, then the account. Each removal is appended to the bus (outbox).
• [ ] A failure partway leaves what is left intact and the result says what was removed; calling it again finishes the job.
• [ ] Only a forge admin; a same-origin check on the mutation as on every other.
• [ ] Tests go in test/accounts.test.ts (already in GATE): nothing changes without confirm; with it the organizations, their repositories and the account are gone and their events recorded; a non-admin is refused. If you add a new test file, add it to GATE in scripts/gate.ts — both earlier tries went red on test/check-list.test.ts. Run bun test test/check-list.test.ts test/accounts.test.ts and bunx tsc --noEmit before pushing.

Files. src/actions/accounts.ts, src/actions/orgs.ts (organization/team removal if missing), the accounts API route, test/accounts.test.ts.

Risks. Deletion order: stop and tear down apps before repositories. Do not loosen last_owner on the plain path.