mark_deleted: atomic last-admin guard; review minors

crates/domain/src/testing/fakes/store_user.rs

@@ -83,6 +83,17 @@ impl UserRepository for InMemoryStore {
         let Some(user) = users.get(&id).filter(|_| !gone.contains(&id)) else {
             return Err(DomainError::NotFound("User not found".into()));
         };
+        if matches!(user.role(), crate::models::UserRole::Admin)
+            && !users.values().any(|u| {
+                matches!(u.role(), crate::models::UserRole::Admin)
+                    && u.id().value() != id
+                    && !gone.contains(&u.id().value())
+            })
+        {
+            return Err(DomainError::Conflict(
+                "the last active admin cannot be deleted".into(),
+            ));
+        }
         self.retired_usernames
             .write()
             .unwrap()