A withdrawn consumer keeps its data, in every provider that holds some (hq issue 241)

mssql disables the login, mongodb takes the user's roles, minio revokes the key and keeps the bucket,
mailu disables the mailbox, gitea prohibits the login instead of purging the user and their
repositories, umami keeps the website. Each provider's create already enables what this locks.

modules/mailu/client.ts

@@ -140,6 +140,11 @@ export class MailuClient {
     await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { raw_password: password, enabled: true });
   }
 
+  /** Withdraw a mailbox and keep its mail: disabled, which applyProvisioned undoes. */
+  async disableUser(email: string): Promise<void> {
+    await this.api("PATCH", `/user/${encodeURIComponent(email)}`, { enabled: false });
+  }
+
   async deleteUser(email: string): Promise<void> {
     await this.api("DELETE", `/user/${encodeURIComponent(email)}`);
   }