[stefan-ernst]

Summary

Related: #438

• Allow authorized operators to retarget, detach, or delete a legacy intake whose stored portal no longer exists.
• Preserve mailbox management, existing/replacement workspace administration, and management of existing/replacement live portals. Only a missing historical portal is ignored; repository failures are propagated.
• Validate replacement target identity and permissions before reading portal configuration, so a missing replacement portal returns 400 rather than 500 and cannot be saved.

Current portal deletion already removes linked intakes. This change repairs the remaining recovery path for orphaned legacy records; it does not change normal deletion, routing, mailbox processing, or configuration requirements.

Regression coverage

Companion tests are on core-tests-internal branch fix/wi-2142-orphaned-intakes. Before the fix, all six admin/delegated-manager recovery cases failed with the reported 400 response. Coverage asserts repaired routing/deletion, exact permission denials with unchanged state, live-portal authorization, invalid replacement targets, and cross-mailbox ownership. Setup uses the production API except for one explicitly documented dangling-reference fixture that current deletion intentionally cannot create.

Validation

Passed:

../core-tests/overlay.sh . -- -tags=test -count=1 -run '^Test(ChannelIntake|DeletePortalChannelRemovesIntakes)' ./tests/...
../core-tests/overlay.sh . -- -tags=test -race -count=1 -run '^Test(ChannelIntake|DeletePortalChannelRemovesIntakes)' ./tests/...
TEST_DB_TYPE=postgres TEST_POSTGRES_DSN='host=localhost port=5432 dbname=postgres sslmode=disable' ../core-tests/overlay.sh . -- -tags=test -count=1 -run '^Test(ChannelIntake|DeletePortalChannelRemovesIntakes)' ./tests/...
scripts/run-golangci-lint.sh run --timeout=5m ./internal/handlers/...

Whole-repository Go lint, SQL/audit/handler-DB/layering/deprecated-API pre-commit guards, and diff checks also passed. Existing ignored frontend build artifacts were copied into the worktree for Go embed. Full application, frontend and browser suites were not run; no frontend source changes.