Disconnect a sign-in method from the authenticated user's account

Detaches the account's handle for the given provider at entire-core. The provider is an opaque id from GET /auth/providers; the handle's provider user id never reaches the browser, the BFF resolves it from core's /me. Refused with a stable reason when the session signed in with that handle (current_session), when no other handle would remain (last_handle), or when core does not admit the provider on its self-service route (not_supported). Requires a valid session cookie and CSRF token; the session is left intact.