feat(deleter): clear or report org delete blockers up front - #1857

Closes #1837. Based on #1865; the forfeit email (#1880) and the check RPC (#1893/#1894) stack on top.

DeleteOrganization now checks everything that blocks the delete before touching any data, and returns every reason together as one failed_precondition response with a PreconditionFailure detail (one violation per blocker). The proto ack field from the issue text was dropped (raystack/proton#497 closed) — unused tokens never block.

What blocks the delete:

• Active subscription on a paid plan (ACTIVE_SUBSCRIPTION): any running subscription whose plan has a priced product. The caller downgrades it to the standard plan through the normal plan-change flow, then retries. Plans resolve lazily — only when a running subscription references one — so a broken plan reference can only affect orgs that actually hold such a subscription.
• Invoice that still asks for money (UNPAID_INVOICE): open and uncollectible invoices the caller can pay, and drafts — the provider finalizes those shortly, and deleting inside that window would silently lose the charge, so they block until payable. "Asks for money" is judged by the provider's amount_remaining, so a negative-total credit note or an invoice fully covered by the customer's credit balance never blocks.
• A running subscription on a plan that no longer resolves blocks with its own message (cancel the subscription, then retry) instead of failing the delete forever.
• Negative token balance (NEGATIVE_TOKEN_BALANCE): the account owes tokens (overdraft). Support settles it.

What does not block:

• A running subscription on a free plan: once nothing else blocks, the delete cancels it itself (immediate, unbilled usage invoiced on the spot), then re-checks the invoices. Every account is judged again before anything is canceled, so a paid subscription created mid-delete blocks without costing another account its subscription first, and a subscription whose provider copy is already gone is skipped rather than failing the delete forever. Paid subscriptions are never canceled by the delete, so a blocked delete never costs the caller a plan they pay for.
• Unused tokens: the delete forfeits them (the client confirms with the user first) and writes the amount to an app.billing.tokens.forfeited audit record. feat(deleter): email the org owners when a delete forfeits tokens #1880 adds the owner email.

Other changes:

• Invoices are judged straight from the billing provider through a new invoice.ListPayableOnProvider — three status-filtered pages, no expansion, no local writes — instead of a full SyncWithProvider, keeping the delete's latency independent of the org's invoice history. An invoice the sync has not stored yet is reported by its provider reference.
• The billing accounts are listed once per delete and passed through the whole flow, and plan lookups share one per-delete cache.
• Deleting an org that is already gone returns not_found before any checks run. Disabled orgs stay deletable.
• New invoice state constant UncollectibleState; first use of errdetails in the repo (google.golang.org/genproto/googleapis/rpc becomes a direct dependency).

🤖 Generated with Claude Code