Revoke a connection

Tells the provider to revoke (best-effort), DELETES the stored credential, and marks the connection revoked. The connection row survives so the audit trail does; the credential does not.

A provider that is unreachable or has already forgotten the grant does not block the deletion — but a failure to delete OUR copy fails the request rather than reporting a revocation that did not happen.

Requires the connectors:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying connectors:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include connectors:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).