feat(be): reap applications no anchor references any more

[sea-snake]

Motivation

Changes

Tests

---

Design: #4222 (docs/ongoing/tracked-default-accounts.md). Overview: #4230.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to dcb9613.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=64dd6474-9a4a-4b85-b5f4-c2c2e4e44d2a&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/internet_identity/src/storage.rs     Implement application reaping logic and conditional storage of applications when references are zero
Bug Fix	► src/internet_identity/src/storage.rs     Reap applications when no references remain and avoid stale memory entries
Test Update	► src/internet_identity/src/storage/tests.rs     Adjust tests to reflect reaping behavior and absence of reaped applications in stable memory
Enhancement	► src/internet_identity/tests/integration/accounts.rs     Add integration test for reaping and application reclaim behavior upon per-anchor sign-ins

[sea-snake]

Folded into #4235. These three cannot be deployed separately: tracking makes every sign-in at a new origin mint an application row from an operation with no per-anchor cap, eviction is what bounds that and the only thing that makes an application's reference count fall, and reaping is dead code without it. Verified rather than assumed — with tracking alone, one anchor signing in at 2 000 origins creates 2 000 reference rows and 2 000 application rows. Shipping a prefix would mean unbounded, attacker-drivable stable-memory growth, so they are now one PR.