Disconnect deletes the users the portal let in

A local Disconnect deletes every portal-mapped user except the account the
instance was enrolled as and superusers, so no inert rows stay behind. The
confirm dialog says so, and Admin → Users refreshes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

backend/tests/test_cloud.py

@@ -93,6 +93,41 @@ def test_disconnecting_ends_remote_access(
         decode_token(portal_token(portal_key))
 
 
+def test_disconnecting_deletes_the_users_the_portal_let_in(
+    client: TestClient,
+    enrolled: User,
+    superuser_token_headers: dict[str, str],
+    db: Session,
+) -> None:
+    """Nothing reaches them once the portal is gone; the rest stay."""
+    member = User(email="member-dc@example.com", hashed_password="x", portal_sub="p-1")
+    boss = User(
+        email="boss-dc@example.com",
+        hashed_password="x",
+        portal_sub="p-2",
+        is_superuser=True,
+    )
+    plain = create_random_user(db)
+    db.add(member)
+    db.add(boss)
+    db.commit()
+    member_id, boss_id = member.id, boss.id
+
+    response = client.delete(
+        f"{settings.API_V1_STR}/cloud", headers=superuser_token_headers
+    )
+    assert response.status_code == 200, response.text
+    db.expire_all()
+    assert db.get(User, member_id) is None
+    assert db.get(User, boss_id) is not None
+    assert db.get(User, plain.id) is not None
+    assert db.get(User, enrolled.id) is not None
+    assert cloud_config.load() is None
+    db.delete(db.get(User, boss_id))
+    db.delete(db.get(User, plain.id))
+    db.commit()
+
+
 def test_status_reports_not_enrolled(
     client: TestClient, superuser_token_headers: dict[str, str]
 ) -> None: