The admin CLI moves a persona to another login and deletes a login; the deploy no longer signs in

The owner took @thepra, which the deploy had made and kept under its own login deploy-smoke for its signed-in check, for
the administrator's login (owner decision 2026-10-17). No persona could change login, so:
- admin move-persona <persona> <root> re-points the persona's link first, so the old login can no longer exchange a token
  for it, then ends its Mastodon tokens and authorizations. Its actor, posts and followers stay; nobody outside is told,
  since nothing they hold changes.
- admin delete-root <root> deletes a login as the client deletes its own (RootRemoval): every persona it still has goes
  with it, announced deleted, and its sessions end.
- admin smoke and the deploy's signed-in step are gone, since the step would make deploy-smoke again and fail to make
  @thepra under it. The deploy keeps its anonymous checks; tools/smoke/oauth.sh stays for the pasture's privapub_token.

Tests: move-persona (the persona listed under its new login only, its old token refused, unknown persona or login exit 1)
and delete-root (the login and its persona deleted, the login refused); the whole suite passes (963).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -169,7 +169,8 @@ made (signing up as "admin" grants nothing):
 cd /var/www/privapub.thepra.dev
 echo '<password>' | ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin create-root <login> --admin   # password on stdin
 ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin promote|demote <root>
-ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin smoke <persona>     # the deploy's: prints "deploy-smoke <new password>"
+ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin move-persona <persona> <root>   # its link moves, its Mastodon tokens end
+ASPNETCORE_ENVIRONMENT=Production ./PrivaPub admin delete-root <root>   # as the client deletes a login: its personas go too
 ```
 
 The deploy runs them as `build-runner`, which owns the published files, reads `appsettings.Production.json` through
@@ -945,9 +946,8 @@ the owner's GoToSocial account.**
   discovery, instance, public timeline). Then it checks that what production should be running is running:
   - NodeInfo and the instance API agree on registrations (closed, invitations only);
   - `/stargazing` says the crawler is on;
-  - **@thepra signs in**: `PrivaPub admin smoke thepra` gives the root `deploy-smoke` a new password, `tools/smoke/oauth.sh`
-    runs the real OAuth flow (the pasture's `privapub_token` uses the same script), the signed-in API is checked, the
-    persona must be undiscoverable, and the token is revoked;
+  - nothing signs in (owner decision 2026-10-17): the deploy's own login, `deploy-smoke`, gave its @thepra to the
+    administrator and was deleted, and the signed-in check went with it;
   - the DB-IP Lite databases, which the server fetches itself (`GeoUpdater`), exist and are at most 40 days old.
 - **The box:** Max (`nuvola.xyz`). Unit `privapub` runs as www-data from `/var/www/privapub.thepra.dev` with
   `ASPNETCORE_ENVIRONMENT=Production`.