deleçao de contas web

backend/internal/app/webauth.go

@@ -246,6 +246,29 @@ func (s *Service) UpdateAccount(ctx context.Context, actor Actor, id int64, role
 	return nil
 }
 
+// DeleteAccount exclui a conta do painel, mantendo sempre um owner ativo (9.6).
+func (s *Service) DeleteAccount(ctx context.Context, actor Actor, id int64) error {
+	account, err := s.store.GetWebAccount(ctx, id)
+	if err != nil {
+		return err
+	}
+	if account.Role == domain.RoleOwner && !account.IsDisabled() {
+		owners, err := s.store.CountActiveOwners(ctx)
+		if err != nil {
+			return err
+		}
+		if owners <= 1 {
+			return domain.ErrLastOwner
+		}
+	}
+	if err := s.store.DeleteWebAccount(ctx, id); err != nil {
+		return err
+	}
+	s.audit(ctx, actor, account.UserID, domain.EventWebAccountDeleted, true,
+		map[string]any{"account_id": id, "username": account.Username, "role": string(account.Role)})
+	return nil
+}
+
 // ResetPassword troca a senha e encerra todas as sessões da conta.
 func (s *Service) ResetPassword(ctx context.Context, actor Actor, id int64, password string) error {
 	if err := crypto.ValidatePassword(password); err != nil {