Removes one domain. From the next login onward, identities in that domain are no
longer admitted.

Existing accounts are not deleted, disabled or unlinked. Removal

governs admission, not the accounts admission already created — which is why the
membership read is never cached: the removal takes effect on the next login rather
than at the end of a TTL.

Removing the LAST domain leaves the deployment unable to admit any federated login.
That is permitted and warned about, not blocked: an operator correcting a mistaken
entry must not have to keep it, and blocking here would be a refusal they cannot act
on.