Disconnect an application

Revokes every token in the grant family. Immediate — revocation is checked on every request rather than cached. Scoped to the caller's workspace, so a guessed grant id from another tenant is a 404 rather than a denial of service against someone else's assistant.

The token rows are kept after revocation on purpose: a last_used_at later than a revoked_at is the evidence that a leaked credential is still being tried.