v0.28.0 — honest destructive actions, hardened API

Security: a "deleted" organization kept authenticating its members, consenting, and minting tokens — the status was written by the console and enforced by nothing. Latent rather than breached (production had none in that state). Now enforced through an exhaustive match with no default, so a status added upstream fails analysis rather than defaulting to allowed.

The console claimed to delete users and did not. There is no foreign key on user_id anywhere, so the guard clause meant to catch leftover records was unreachable — every "User deleted" left the person's sessions, passkeys, TOTP seeds and full SCIM payload behind, with no event and no audit entry. Removed rather than repaired; deactivation is the honest capability today.

Compliance: the docs inherited a GDPR Art. 17 claim with no implementation behind it. Corrected.

API hardening before the Terraform/CLI expansion: the documented error envelope is now actually honoured (validation failures rendered Laravel's default shape, with no error key that both specs declare required), rate limits bucket per credential instead of per IP (one NAT meant one shared bucket across tenants), and every API response in the suite is validated against its documented schema — which found eight routinely-null fields typed as non-nullable, plus a documented field the API has never returned.

Operators can now suspend accounts.