Disconnect the workspace — owner-only, mirroring tenant deletion.

Revokes the bot token on Slack's side first (best-effort — see revoke_remote_installation), deletes the API key minted for /cognee-recall (so it doesn't outlive the connection it was created for), drops this account's channel routes, then marks the stored installation revoked locally. Order matters only in that the remote call still needs the token, which local revoke doesn't erase.

Routes go here rather than being left dormant: they are keyed on the account, not the tenant, so a leftover route re-arms the moment anyone reinstalls this workspace (see delete_routes_for_account). A re-authorization for new scopes does not pass through this endpoint, so routing config survives that case as intended.