Delete an upstream API credential

Permanently delete a credential.

The credential is removed from the vault and unbound from all toolkits that reference it. Agents using toolkits with this credential will immediately lose access to the upstream API.

For credentials backed by Pipedream OAuth (auth_type == 'pipedream_oauth'), the upstream Pipedream grant is also revoked so the connection cannot be re-used out-of-band. Failures on the upstream revoke are logged but do not block local deletion — local cleanup is the source of truth.

Auth: Requires human session OR agent key with explicit DELETE /credentials allow rule on jentic-mini credential.

Warning: This operation cannot be undone. The secret value is irrecoverably destroyed.