Offboard cleanup: disconnect all of a tenant's connected accounts

Connected accounts that were active and got disconnected locally.

Of those, how many were confirmed revoked at the provider.

Accounts with a leak-state outcome or an open Billit refresh residual, counted once per account.

Of the orphaned ones, how many failed on our side with no provider answer recorded, rather than the provider being unreachable. Anything above zero needs a human: usually a bug to fix, sometimes a debt that cannot be built into an authenticated request, sometimes an absent signing key. Never an outage to wait out.

Accounts this pass could not finish: the provider call ran but its bookkeeping would not save, or the turn failed before the call. Above zero, those accounts may have no retry queued, and re-running this route will NOT pick them up — they are already locally disconnected, which is what makes the route idempotent. Read the leak report before revoking anything by hand: one of the cases counted here is a cycle that was superseded, where the member reconnected while the sweep was mid-flight, so the credential is live because it is IN USE rather than leaked. The report tells those apart; this number does not.