service actor undeletable: domain const, 403, hide delete UI

crates/application/tests/users/request_account_deletion_test.rs

@@ -287,3 +287,18 @@ async fn a_non_admin_gets_forbidden_before_any_password_check() {
 
     assert!(matches!(err, DomainError::Forbidden(_)), "got {err:?}");
 }
+
+#[tokio::test]
+async fn the_service_actor_cannot_be_deleted_even_by_an_admin() {
+    let f = fixture();
+    let admin = f.user("root", UserRole::Admin).await;
+    let other = f.user("second", UserRole::Admin).await;
+    let _ = other;
+
+    let err = request_account_deletion::execute(&f.deps, admin, UserId::service_actor(), PASSWORD)
+        .await
+        .unwrap_err();
+
+    assert!(matches!(err, DomainError::Forbidden(_)), "got {err:?}");
+    assert!(f.store.recorded_events().is_empty());
+}