Disconnect an account

Revokes the token at the provider (best effort; providerRevoked says whether it accepted) and marks the grant revoked. Connections that run as it fail their next sync by name until reconnected. Connected accounts (docs/source-plane.md § Connected accounts): the brain as an outbound OAuth 2.1 client for the cloud connectors (gdrive, onedrive, dropbox). Answers a bare 404 until SOURCE_PLANE_ENABLED=1 and SOURCE_OAUTH_CLIENT=1; needs SOURCE_CREDENTIAL_ENCRYPTION_KEY — tokens are never stored in the clear.

Required scope: brain:admin.