Missing endpoint to Deactivate via OAuth

[tynanpurdy]

There is currently no way to deactivate an account with an OAuth session. I think this should be added so that account migration flows using OAuth can complete the process by deactivating the old account. Tranquil PDS has a flow like this and cannot do so, resorting to asking the account owner to go back and deactivate it themself.

I understand that there may be some protective friction behind reserving dangerous scopes for password auth only, however I don't think that bears true in experience. It would be better to facilitate the only place you enter your real password being on a login page on your actual PDS. The risk of allowing such a scope in OAuth can be mitigated with a Big Scary Warning on that scope in the consent screen.

[nelind3]

To be clear it's not like there isn't an endpoint that could work. com.atproto.server.deactivateAccount in the ref impl just specifically disallows the use of an OAuth session https://github.com/bluesky-social/atproto/blob/d3bbeb5fe87f8c389c2f18abd2bc055ef916a63a/packages/pds/src/api/com/atproto/server/deactivateAccount.ts#L14. Thus we can't call this Tranquils OAuth based migrator.

Which seems weird to me. That doesn't have any particular safety implication, OAuth sessions are allowed to do a complete migration if they have the right scopes, a deactivation shouldn't be that problematic to allow. There is however no specific OAuth scope yet to gate this behind. The specs for permissions mentions that the account resource type includes "hosting status, email address" https://atproto.com/specs/permission#resource-types, but then the part specifically on that resource type doesn't have anything for controlling hosting status https://atproto.com/specs/permission#account. Only email and repo import. Seems like we need a status account component/attribute that allows for activation and deactivation of the account, not having that seems like quite the hole in the current OAuth scopes.