Delete every row and file this engine holds for user_id, named by an OPERATOR.

The door for a tenant DELETE /tenant can never reach: that route authenticates with an entitlement token and purges the token's own sub, so a user already removed from platform Postgres is stranded — nothing can mint a token for a sub that no longer exists. Same class as a support-initiated erasure of a person whose account is already gone.

Guarded by require_admin (X-VoiceLabs-Admin against VOICELABS_ADMIN_TOKEN, the same convention as POST /tasks/clear): a wrong or absent token gets 404, never a 403 that would confirm the route exists. Because that guard is a deliberate no-op when SaaS is off, this route additionally answers 404 with the flag off — on a desktop/self-host install every row belongs to the NULL owner, there is no tenant to name, and an ungated destructive route must not be reachable by a LAN peer.

A blank or whitespace-only id is refused with 400 by :func:purge_tenant itself, and an empty path segment never routes here at all — the NULL tenant is not addressable through this door any more than through the other one.

Answers exactly what DELETE /tenant answers: 200 with the report when the tenant re-counts empty, 500 with the same report when anything survived.