service actor undeletable: domain const, 403, hide delete UI

crates/application/src/users/request_account_deletion.rs

@@ -12,6 +12,12 @@ pub async fn execute(
     target: UserId,
     password: &str,
 ) -> Result<(), DomainError> {
+    if target.is_service_actor() {
+        return Err(DomainError::Forbidden(
+            "the instance service account cannot be deleted".into(),
+        ));
+    }
+
     let actor_user = deps
         .user
         .find_by_id(&actor)

crates/application/tests/users/request_account_deletion_test.rs

@@ -287,3 +287,18 @@ async fn a_non_admin_gets_forbidden_before_any_password_check() {
 
     assert!(matches!(err, DomainError::Forbidden(_)), "got {err:?}");
 }
+
+#[tokio::test]
+async fn the_service_actor_cannot_be_deleted_even_by_an_admin() {
+    let f = fixture();
+    let admin = f.user("root", UserRole::Admin).await;
+    let other = f.user("second", UserRole::Admin).await;
+    let _ = other;
+
+    let err = request_account_deletion::execute(&f.deps, admin, UserId::service_actor(), PASSWORD)
+        .await
+        .unwrap_err();
+
+    assert!(matches!(err, DomainError::Forbidden(_)), "got {err:?}");
+    assert!(f.store.recorded_events().is_empty());
+}