Clears idp_id and external_subject on every account
reported by the companion read, and returns those bindings as they were before the
repair (PRD §152.7).

The accounts are unbound, never deleted — the same decision the provider
deletion path makes, and for the same reason: these principals carry roles and are
referenced by audit rows. Afterwards each is an ordinary local account, so
"Authorize a link" can bind it to a live provider — the remedy an orphan could not
reach.

Idempotent by construction, not by a guard: the scan selects accounts whose
idp_id names no existing provider, so a repaired account is outside its

result set. A second call finds nothing, writes nothing and audits nothing, and
answers 200 with empty bindings. When
truncated is true there were more orphans than one pass repairs —

repeat until it is false.

Confirmation is required. expectedBindings must equal the

number of orphans the companion read reports. A mismatch answers 409
and repairs nothing: this is a single POST that mutates principal state in every
tenant at once, so it must not be reachable from a mistyped URL or a stale tab.

Required scope: admin.platform.idp.manage.