Disconnect deletes the users the portal let in

A local Disconnect deletes every portal-mapped user except the account the
instance was enrolled as and superusers, so no inert rows stay behind. The
confirm dialog says so, and Admin → Users refreshes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

backend/fluksio/api/routes/cloud.py

@@ -281,19 +281,31 @@ def forget_remote_user(portal_sub: str) -> None:
 @router.delete(
     "", dependencies=[Depends(get_current_active_superuser)], response_model=Message
 )
-def disconnect(request: Request) -> Message:
+def disconnect(request: Request, session: SessionDep) -> Message:
     """Sever the connection from this side.
 
     Unilateral and immediate: the config is the only reason portal tokens
     verify here, so deleting it ends remote access whatever the portal still
-    has on file.
+    has on file. The users the portal let in go with it. The account it was
+    enrolled as stays, and so does every superuser.
     """
     task = getattr(request.app.state, "cloud_task", None)
     if task is not None:
         task.cancel()
         request.app.state.cloud_task = None
     request.app.state.cloud_connector = None
+    config = cloud_config.load()
     cloud_config.delete()
+    owner = config.local_user_id if config is not None else None
+    for user in session.exec(
+        select(User).where(
+            col(User.portal_sub).is_not(None),
+            User.is_superuser == False,  # noqa: E712
+        )
+    ):
+        if str(user.id) != owner:
+            session.delete(user)
+    session.commit()
     return Message(message="Disconnected from the portal")