A withdrawn consumer keeps its data, in every provider that holds some (hq issue 241)

mssql disables the login, mongodb takes the user's roles, minio revokes the key and keeps the bucket,
mailu disables the mailbox, gitea prohibits the login instead of purging the user and their
repositories, umami keeps the website. Each provider's create already enables what this locks.

modules/mssql/client.ts

@@ -256,6 +256,14 @@ export class MssqlClient {
   }
 
   /** Drop a database and its login, idempotently, after evicting live connections. */
+  /** Withdraw a consumer and keep its database: its login is disabled, which create undoes. */
+  async disableLogin(login: string): Promise<void> {
+    const logins = await this.query(
+      `SELECT 1 AS ok FROM sys.server_principals WHERE name = ${literal(login)}`,
+    );
+    if (logins.length > 0) await this.exec(`ALTER LOGIN ${ident(login)} DISABLE`);
+  }
+
   async dropDatabaseAndLogin(database: string, login: string): Promise<void> {
     const dbs = await this.query(
       `SELECT 1 AS ok FROM sys.databases WHERE name = ${literal(database)}`,