feat: strengthen risk controls and review workflows

gateway/internal/control/server.go

@@ -86,6 +86,11 @@ type DownstreamRecoveryOverview struct {
 	Statuses   []inbound.DownstreamRecoveryStatus `json:"statuses"`
 }
 
+type DisconnectDownstreamAccountCommand struct {
+	Account string `json:"account"`
+	Reason  string `json:"reason"`
+}
+
 func Register(mux *http.ServeMux, server Server) {
 	if server.HTTPClient == nil {
 		server.HTTPClient = &http.Client{Timeout: 10 * time.Second}
@@ -110,6 +115,30 @@ func Register(mux *http.ServeMux, server Server) {
 	mux.HandleFunc("/downstream/recovery-candidates", server.handleDownstreamRecoveryCandidates)
 	mux.HandleFunc("/downstream/recovery-statuses", server.handleDownstreamRecoveryStatuses)
 	mux.HandleFunc("/downstream/recovery-overview", server.handleDownstreamRecoveryOverview)
+	mux.HandleFunc("/downstream/connections/disconnect", server.handleDisconnectDownstreamAccount)
+}
+
+func (s Server) handleDisconnectDownstreamAccount(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	var command DisconnectDownstreamAccountCommand
+	if err := json.NewDecoder(r.Body).Decode(&command); err != nil {
+		http.Error(w, fmt.Sprintf("invalid downstream disconnect command: %v", err), http.StatusBadRequest)
+		return
+	}
+	if command.Account == "" {
+		http.Error(w, "account is required", http.StatusBadRequest)
+		return
+	}
+	disconnected := inbound.DisconnectAccount(command.Account)
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"account":      command.Account,
+		"disconnected": disconnected,
+		"reason":       command.Reason,
+	})
 }
 
 func (s Server) handleConnectChannel(w http.ResponseWriter, r *http.Request) {