Bulk delete

IRREVERSIBLE. Purges every id in the body via the same transactional full purge as DELETE /accounts/{id} (each id its own transaction; see docs/data-retention.md) — not a bulk deactivation. Per-target ResourceAuth manage is enforced independently for each id (a tenant_admin can only delete within their own tenant); the response reports succeeded/failed counts and a per-id ok|forbidden|error result, so a partially-authorized batch still deletes everything it was allowed to.