Expire Account

Disable a workspace whose trial has expired. Idempotent.

Disables rather than deletes: an expired trial that later converts should resume without the customer redoing setup. Existing grants are moved to reconnect-required and their tokens discarded, so an expired account cannot keep querying.