LDAP sync should deactivate or delete users and groups removed upstream

## What

when a user/group is deleted from the external LDAP/AD catalog, authentik should deactivate or delete the local copy on sync. Also: LDAP sync of account state: lock/disabled status from Fusion Directory is ignored; deleted AD objects are not removed. Same “sync should reflect directory state” ask.

## Want

- When a user/group is deleted from the external LDAP/AD catalog, authentik should deactivate or delete the local copy on sync
- Related LDAP sync of account state: lock/disabled status from Fusion Directory is ignored
- Deleted AD objects are not removed

## Ideas this came from

- [#3986 Is there are any ways to deactivate users that was deleted from AD (i'm syncing all users to authentik from our active directory) automatically?](https://github.com/goauthentik/authentik/issues/3986) — Hi there I have a question about users and ldap source Is there are any ways to deactivate users that was deleted from AD (i'm syncing all users to authentik fr
- [#6408 Authentik does not delete entities like users and groups from its DB when a user or a group were deleted from the external LDAP Catalog.](https://github.com/goauthentik/authentik/issues/6408) — I delete a group on FreeIPA then click the SYNC button on Authentik's LDAP Federation. Sitting and waiting for Authentik is going to delete the group, but it is
- [#9969 Authentik Does Not Respect User Lock Status from Fusion Directory](https://github.com/goauthentik/authentik/issues/9969) — ### Question Description: I am using Authentik for SSO authentication, integrated with Fusion Directory for user management via LDAP. When I lock a user in Fusi

## Out of scope

LDAP outpost password bind (#2112) is not source writeback. Leave it open.

Start at the LDAP sync entry point and trace how users and groups are matched against the external catalog. Determine the expected handling for missing objects and Fusion Directory lock or disabled state; done means sync reflects those directory changes, including removed AD objects, without expanding into password writeback.

Written by the indexing model from the issue text.