Disconnect an authorized application

Reuses browser-session-owned OAuth grant revocation with exact same-origin and CSRF validation. Disconnecting revokes only the selected authorization and its access/refresh tokens, then redirects to Settings Applications with one-time success feedback. Browser sign-out is separate.

Response headers:

• Cache-Control (303): no-store.
• Referrer-Policy (303): no-referrer.
• Location (303): Settings Applications after successful revocation.

Additional request headers:

• Origin (required): Must exactly match the Bibleit origin; the browser-session-bound CSRF form value is also required.