Need ability to block account deactivation functionality homeserver-wide

I'm in a scenario where I'm spinning up an isolated Matrix ecosystem. No federation, all on-prem, and all users are expected to authenticate against LDAP/Active Directory.

Naturally the expectation is that accounts working/not and their credentials is to be dictated by the upstream LDAP/Active Directory Domain Controllers, and not Matrix.

Thus-far I have that mostly how I want it, however in my testing just now I was able to deactivate an account via a Matrix client, and that's a huge problem. Not only that, I'm not seeing a way to block account deactivation from Matrix clients environment-wide.

From a UX perspective we need the ability to disable users from deactivating their accounts as that leads to huge data loss and other security problems, as well as IT admin overhead problems during "oops" accidental scenarios.

Frankly I'm surprised this hasn't come up before.

Can we please have this feature added so that we can disable account deactivation environment-wide?

No files, tests, or entry points are named. Trace Synapse's account-deactivation handling and homeserver configuration, then determine how a global setting should prevent client-triggered deactivation while preserving LDAP/Active Directory account management; done means the behavior is blocked environment-wide and covered by tests.

Written by the indexing model from the issue text.