Delete a tenant

Permanently deletes the tenant and all resources owned by it (buckets, objects, S3 access keys). The operation is irreversible.

The tenant must be in the disabled state before deletion. The caller is expected to first cut off all access via POST /tenants/{tenantId}/status with status: disabled, then invoke this endpoint to commit the deletion. Calls against a tenant in any other status return 409.

Synchronous: the response is returned only after every owned resource has been removed. Idempotent: a call against a tenant that is already gone returns 204.

If cleanup of one or more owned resources fails partway through, the Service Orchestrator must return 5xx and the tenant must remain deletable on retry — there must be no half-deleted, undeletable state.