Okta: remove user when they leave

[LuD1161]

🟢 Open

Goal:
Ensure the user no longer occupies a paid Okta license or active directory seat.

Tasks:

• Research Okta seat/license rules (assigned vs unassigned users, app access vs directory presence).
• Identify Okta API(s) to deactivate and delete user accounts.
• Input: okta_username, email, or user_id.
• Steps: resolve user → deactivate → remove from groups → revoke sessions → delete user record.
• Verify Okta admin dashboard reflects released license seat.
• Emit audit JSON (groups removed, deactivation time, final user status).

Acceptance:

• Dry-run supported (simulate API calls).
• Idempotent (safe to run multiple times).
• Unit tests with mocked Okta API.