Reports every live account whose idp_id names a provider that has been
deleted (PRD §152.7). Such an account is unreachable: the federated login
resolves subject-first on (tenant_id, idp_id, external_subject), so the
binding is never matched, every later login is treated as a first login, and it then
collides with the email address the orphan itself still occupies — the operator sees
a repeating 409 with no remedy, because "Authorize a link" relinks an
account TO a provider and that provider is gone.

Deleting a provider now unbinds its accounts, so no NEW orphan can be created. This
read exists for the ones already written in environments deployed before that, and it
is the read an operator inspects before invoking the repair. It mutates nothing.

Results span EVERY tenant: a deployment-scope provider is stored under the platform
tenant and inherited by all of them, so its orphans are not confined to one.

The response is a bounded pass: { bindings, truncated }. The
ceiling applies to the ORPHANS, not to the federated population, so repeating the
call advances — each repaired account leaves the result set. While
truncated is true, bindings remain unexamined and the call should be

repeated.

Required scope: admin.platform.idp.manage.