Close this tenant's access to the account

Removes this tenant’s access to the account. The HTTP response is the same whether another CorpX tenant still operates the bank account or this tenant is the last one: the caller cannot tell.

Humans need tenant_manager or admin. Credentials need the accounts.close scope (legacy api2/write still passes). A viewer cannot close.

The row is not deleted. It becomes status=closed with status_source=tenant_close. Already closed in this tenant returns the same 200 without a second email.

When this tenant is the last one still operating the account, the raw settlement-bank balance must be zero (total, available and locked). Any non-zero value returns 422 account_has_balance and leaves the row active. A zero exclusive close emails MT support and then closes the row.

Binding to another tenant’s account, a missing account, or a suspended row is always 404 account_not_found — never 403 tenant_mismatch.