The chart could only be created and edited. Restructuring it — the thing that
actually gets asked for — meant a developer.

Adds move / delete / promote-demote with the guards a ledger needs, each refusing
with the specific reason rather than failing later at month end:

MOVE
- Refuses a move under the account's own descendant, which would detach the
  subtree from the root and make the tree query loop.
- Refuses a parent of a different account_type — that would file an asset under
  liabilities and quietly corrupt the balance sheet.
- Refuses a non-header parent.
- Carries the whole subtree and recomputes every level beneath.

DELETE
- An account with posted history is ARCHIVED, never deleted: removing it would
  leave old journal lines pointing at a name that no longer exists. The button
  relabels itself to "أرشفة" and says why.
- Refuses while children exist, or while anything still points at it — posting
  rules, tax profiles, voucher types, vouchers, bank accounts, treasuries — and
  lists what, so the blocker is actionable.
- System accounts can be deactivated, not removed.

PROMOTE / DEMOTE
- Refuses to promote an account that already carries movement; a header takes no
  entries, so its balance would be stranded.
- Refuses to demote one with children; entries would post at a summary level and
  double-count up the tree.

The management panel loads the usage check before offering anything, so a button
that is going to be refused is disabled with the reason instead of being offered
and failing.

Reference scanning tolerates a missing table or column, so a trimmed or older
install does not break the screen. Descendant walking is iterative and guarded
against a pre-existing cycle rather than recursing into a hang.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>