Function cleanup_account_secrets 

pub fn cleanup_account_secrets(
    acct: &IdentityAccount,
    identities_root: Option<&Path>,
) -> SecretCleanup

Best-effort removal of the on-host credential material behind acct.secret_ref. Never returns Err — account deletion must not be blocked by cleanup trouble; every outcome is logged.

identities_root is the agentmux identities root (DataPaths::identities_dir()), None when DataPaths::from_env() could not resolve (CI / unusual envs) — OAuth dirs are then skipped, never guessed. Blocking (keyring + fs) — call via spawn_blocking from async contexts.