Revoke an OAuth client connection

Revokes the refresh tokens for an OAuth client family (e.g. an MCP client) so it can no longer mint access tokens. Pass family_id to revoke ONE grant — a client the user authorized twice has two, and each is its own row in GET /connections. Omit it to disconnect the client entirely, which is what frees a connection-cap slot. vault_id is the older, coarser narrowing and is ignored when family_id is given: it revokes, whole, each of the client's grants that can reach that vault. A grant with per-vault levels counts as reaching it at read or write, and through its new-vaults policy; a grant that lists vaults without levels, when the vault is one of them; and an all-vaults grant, which reaches every vault. A revoked grant's access tokens stop working at once and its live sockets are disconnected. Session-auth only.