Unlink a node from the signed-in account

Revoke a node the session owns and its credentials, then tell the relay.

The cascade runs under the node's own compare-and-set and inside the same transaction, so there is no moment in which the node is unlinked while a connector's refresh family still reads as live. It is bookkeeping rather than the thing that stops the access — every credential path re-reads the node row on every presentation — but it is what keeps /security truthful, what lets the purges reclaim the rows, and what writes the per-subject audit detail underneath this route's NODE_UNLINK umbrella (plan D-P6.2/D-P6.12).

The credentials' streams are ended after that transaction commits, alongside the relay tombstone rather than inside the cascade: a close_stream frame survives the rollback of the transaction that sent it, so a retryable transaction must not send one. The consumers are killed before the revoke_node frame so that what they are told is access_revoked rather than whatever a dropped tunnel synthesises.