auth_providers was missing from ScopedCollections, so reap.go's scopedCollectionsForPurge() (derived from that list) never deleted an instance's providers, leaving orphaned rows holding encrypted client secrets forever. Verified migration 0004's $rename over org_id->instance_id is a no-op here since auth_providers never carried org_id.