Disconnect Integration

Disconnect ONE MCP connection and remove its stored credentials.

Deliberately does not check is_provider_enabled_for_org/the org's rollout flag: revoking an existing grant must never be trapped behind a flag that got turned off or removed after connecting -- so the ungated provider lookup is used purely to read the ownership axis.

Authorization:

• org-shared provider: org admin, as before. target_user_id is meaningless there and is rejected rather than silently ignored.
• user-scoped provider: a member disconnects their own connection with no admin gate; disconnecting ANOTHER member's connection (offboarding) is an explicit admin action that must name target_user_id.