feat: contribute tenant erasure for access data

docs/ACCESS_MODULE_BOUNDARY.md

@@ -25,6 +25,9 @@ contracts.
 - tenant owner provisioning and default access bootstrap
 - materializing governance templates into access-owned groups and roles
 - access-owned SQLAlchemy metadata and migrations for `access_*` tables
+- the `tenancy.erasure_provider.access` contribution, which previews and
+  idempotently removes only target-tenant credentials and authorization rows
+  while retaining global accounts and identities shared with other tenants
 
 The active access tables use the `access_*` namespace while the model classes
 live in this module: `access_accounts`, `access_users`, `access_groups`,
@@ -64,6 +67,22 @@ Access declares tenancy as an optional module integration. It uses the
 core-owned `core_scopes` table as the scope table, but it must not import
 `govoplan_tenancy` or require the tenancy package to start.
 
+## Tenant-Erasure Boundary
+
+Access implements the Core tenant-erasure provider contract without importing
+Tenancy. Its preview counts every Access table with a tenant boundary. The
+first destructive step removes target-tenant sessions and API keys; the second
+removes service accounts, memberships, groups, tenant roles, organization
+units, functions, assignments, and delegations in dependency-safe order.
+Both steps are database-transactional and idempotent, so reconciliation can
+repeat them after an interrupted response.
+
+Global accounts, system-role assignments, identities, and identity-account
+links are intentionally retained: they are installation-wide facts and may be
+used by another tenant. Provider previews and receipts contain counts and
+stable references only, never password hashes, session tokens, API-key hashes,
+email addresses, or other credential material.
+
 ## Core-Only Startup Contract
 
 A core-only installation must be able to start far enough to expose process