org-admin

Step 1 of 2. Produces the full export (rules with audit history, gaps, staleness, calibration/contradiction findings, ROI counters, onboarding events, key/connection metadata — never secrets) and mints a confirmation token scoped to this org. Calling this again before confirming just re-exports and overwrites the previous token (the old one stops working) — there is deliberately no limit on how many times an admin can re-request before actually confirming.

Step 2 of 2 — irreversible. Requires the exact token /request just issued for THIS org (never another org's — the key is org-scoped, so a caller can never hold a valid token for anyone but their own org), unexpired, unused. Deletes apps/store's rules mirror first (the more likely-to-fail-partway network call), then every org-scoped Postgres row — see gnt.org_offboarding.delete_org_postgres_data for the full, authoritative table list.