`delete_namespace` can leave leftover data

If possible delete_namespace should delete everything in a single transaction. It seems in its current form it can leave leftover data (eg: an Account that doesn't belong to a Namespace).

I have not been able to reproduce the error, but I noticed the following chain of events:

• Account deletion was requested (endpoint here).
  • Account is queried using namespace_public_id and succeeded
• Account deletion started. The account namespace is deleted at this point
• A deployment happened, leaving that account in a "half-deleted" status
• delete-marked-accounts tries to get_accounts_to_delete, but it fails when building the list of tuples because the account doesn't have a namespace anympre

Start with delete_namespace and get_accounts_to_delete in inbox/models/util.py, then trace the account-deletion endpoint in inbox/api/srv.py and delete-marked-accounts.py. Determine whether the deletion workflow can be made atomic, and verify that an interrupted deletion cannot leave an Account without its Namespace.