Remove a device push token for the assistant owner.

Idempotent — returns 204 even if the token does not exist for the given (user, token, bundle_id) triple.

Authenticates via either session or AssistantAPIKey (see :class:DevicePushTokenUpsertView docstring). The web/iOS WebView logout path in web/src/lib/auth.tsx calls this BEFORE allauthLogout() so the session cookie is still valid.

The bundle_id query parameter is REQUIRED so the delete is scoped to a single (user, token, bundle_id) row. Without it, a user who legitimately had the same token registered under two app bundles (e.g. main app and a TestFlight build) would lose both registrations on a single logout, which would silently disable push for the other app. The model's unique constraint is (user, token, bundle_id), so the delete filter must match all three to be safe.