Terminate a practitioner with cascade

Terminates a practitioner and applies the appropriate termination cascade based on the supplied terminationType; different termination types update different sets of records and follow different cascade rules. Use this when a practitioner's engagement is ending in full or in part — for terminating a single role at a specific location-network assignment, use PUT /practitioners/practitioner-role-assignments/{id}/terminate, and for ending a specialty only, use PUT /practitioners/tenant-practitioner-specialties/terminate. The request body must include terminationType; an active credentialing or monitoring workflow blocks termination with a 409 response until the workflow is resolved (except FULL_EXIT, which bypasses this guard). The 9 supported terminationType values are: GROUP (requires tenantPractitionerId, tenantGroupId, terminationDate; terminates the group membership plus all network, location, and location-network associations under it, optionally narrowed to one network via networkId), NETWORK (requires networkId; terminates the network participation and cascades to all location-network associations under that network), GROUP_LOCATIONS (requires tenantGroupLocationId; terminates that location association, and additionally cascades to end network enrollment at that location only when both the practitioner.termination.group-locations.cascade-network.enabled config flag is on and the request sends acknowledgedLocationNetworkTermination=true — omitting it keeps the legacy GPL-only termination, not an error), LOCATION_NETWORK (requires tenantGroupLocationPractitionerNetworkId, or the tenantGroupLocationId/networkId pair; terminates that location-network record and cascades only to its location-network specialties), NETWORK_SPECIALTY and GROUP_SPECIALTY (identical cascade logic; each independently terminates the network-participation specialty when tenantGroupPractitionerNetworkId/tenantGroupPractitionerSpecialtyId are supplied and/or the location-network specialty when tenantGroupLocationPractitionerNetworkId/tenantGroupPractitionerLocationSpecialtyId are supplied, skipping whichever pair is absent rather than erroring), GROUP_LOCATION_SPECIALTY (independently terminates the group-location specialty when tenantGroupPractitionerLocationId/tenantPractitionerSpecialtyId are supplied and/or the location-network specialty when the same network-specialty ID pair above is supplied), INFERRED_LOCATION (requires tenantGroupLocationId but NOT tenantGroupId — terminates all group and network relationships at that location across every group the practitioner belongs to there; multiple matches are expected and all are terminated, not an error), and FULL_EXIT (certifyPractitionerId is MANDATORY — this is the only termination type that does not use tenantPractitionerId; a request with terminationType=FULL_EXIT and no certifyPractitionerId returns 400. tenantGroupId and every other scope field must also be omitted — wipes every group, network, and location relationship the practitioner has). INFERRED_LOCATION and FULL_EXIT may return 400 if not yet available for the calling tenant, when tenantGroupLocationId is missing for INFERRED_LOCATION, or when certifyPractitionerId is missing for FULL_EXIT. INFERRED_LOCATION additionally returns 400 when the practitioner has no active relationships matching the request at that location at all — unlike the 404 the 7 legacy types return when their scoped association isn't found. FULL_EXIT has no equivalent "nothing found" error: a practitioner with zero group/network relationships still succeeds with 200 — there's nothing to cascade-terminate at the group level, but the practitioner and CorePractitioner crosswalk are still expired and any active credentialing/monitoring work is still cancelled.