Turn managed mode OFF without disconnecting

Drops the stored grant (async one-click, or a kept provider sign-in, which is also revoked at the provider where it allows it) and clears the connection's managed flag, leaving the connection and its applied records in place. The records the provider already wrote stay live; the control plane simply stops holding a credential to re-apply / revert them. This is not DELETE /v1/connections/{id} (which reverts the template at the provider and removes the whole connection). Idempotent: a connection that is already unmanaged returns 200.