Hard-reset disconnect for a single integration.

Behavior:

1. Delete every Composio connected_account for this (user_id, toolkit_slug). Source of truth for connection state lives in Composio (see GET /connections); once removed, the next /connections poll returns no row for this slug, so the UI badge naturally flips to "Not connected".
2. Best-effort: clear the access-policy grants so a future re-connect starts at access_mode='none' (Settings UX) rather than carrying a stale "selected" set the user can't see.

Already-ingested Bronze data and existing societies are untouched — they live in BigQuery / bronze_doc_entity_links. Only future fetches break until the user reconnects.

Deliberate scope: We do NOT update society_source_connections.status for past societies that used this connection. That table is keyed by society_id, and mapping a Composio user back to "all societies this user owns" requires a join through organization_users + organization_societies that's bigger than this endpoint. The pipeline's refresh path re-resolves the live Composio account by make_composio_user_id(uid, product_name) rather than reading composio_connection_id from the row (the column is declared in the migration but currently never written — see digital-twin-api/migrations/2026_05_society_source_connections.sql:23), so a stale status='connected' on past rows is a UI hint that goes stale, not a correctness break. Refresh-on-disconnect for historical rows is a follow-up.

Returns the deleted account id list so the UI can log/toast the outcome ({"deleted": N, "deleted_ids": [...], "status": "disconnected"}).