Deletes the provider, freeing the one-per-kind slot. Cascades all three child sets and its link intents, and UNBINDS every account bound to it across all tenants: both federation columns are cleared, a password change is required (binding had replaced the local password with an unusable value) and the revocation epoch is advanced so the deleted federation's sessions end. Refused with 409 when that would leave a tenant with no account able to sign in. Required scope: admin.platform.idp.manage.