fix(datatables): warn when a settings sync strands fork pointers

A settings save reported the fork pointers left resolving to nothing only
for the names in `deleted_datatables`, which `wmill sync push` never sends.
The save now works out what it removed from the locked entries, and the
CLI prints the stranded pointers it returns.

Also correct the replication helper's contract: no role or admin check
makes a replication connection safe, so a data table under roles is
refused outright rather than gated as an admin operation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BjfMkJyKzodxkobqGZ6Lqb

backend/windmill-api-workspaces/src/workspaces.rs

@@ -3875,6 +3875,18 @@ async fn edit_datatable_config(
         }
     }
 
+    // Worked out from the locked entries rather than taken from `deleted_datatables`: a settings
+    // sync sends the whole map without that list, and dropping a governing entry strands every
+    // fork pointing at it all the same.
+    let removed: Vec<String> = old_datatables
+        .keys()
+        .filter(|name| {
+            !new_config.settings.datatables.contains_key(*name)
+                && !new_config.renames.iter().any(|r| &r.from == *name)
+        })
+        .cloned()
+        .collect();
+
     let config: serde_json::Value = serde_json::to_value(new_config.settings)
         .map_err(|err| Error::internal_err(err.to_string()))?;
 
@@ -3914,7 +3926,7 @@ async fn edit_datatable_config(
     // A deletion cannot be followed the same way — there is nothing to point at any more. Read who
     // is left stranded so the caller is told, the way deleting a workspace does.
     let mut stranded: Vec<StrandedReference> = Vec::new();
-    for name in &new_config.deleted_datatables {
+    for name in &removed {
         let rows = sqlx::query!(
             r#"SELECT ws.workspace_id AS "workspace_id!", dt.key AS "datatable!"
                FROM workspace_settings ws