fix: clean up replicatedInstances and registry on federation identity deletion

After deleting a federated identity, the server-side user_federation_registry
and users.replicated_instances were not cleaned up, causing "already connected"
errors when trying to re-federate. The deletion endpoint now authoritatively
removes both the registry row and the replicatedInstances entry, and bumps the
LWW timestamp to prevent stale client syncs from re-inserting them.

Also extends the endpoint to accept mode 'leave' (skip S2S, just clean up),
and enables the "Select instances..." scope option in DeleteIdentityDialog.

packages/shared/src/types.ts

@@ -710,7 +710,7 @@ export interface DeleteAccountRequest {
 
 export interface FederationIdentityDeleteRequest {
   origins: string[];
-  mode: 'soft' | 'full';
+  mode: 'leave' | 'soft' | 'full';
 }
 
 export interface FederationIdentityDeleteResult {