identity: "disconnect app" — revoke_app(Subject, Client) (+4 tests)

identity_tokens:revoke_app(Subject, Client) revokes every grant a subject
holds for one client at once (audited one revoke per grant), exposed at the
facade as identity:revoke_app. The action counterpart to the grants view —
completing the account-security view+action pairs (sessions/logout_all,
grants/revoke_app, history). Other subjects' same-client grants are
untouched. account 11/11, 233/233.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,7 +1,7 @@
 {
   "language": "identity",
-  "total_pass": 229,
-  "total": 229,
+  "total_pass": 233,
+  "total": 233,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
     {"name":"token","pass":24,"total":24,"status":"ok"},
@@ -24,6 +24,6 @@
     {"name":"introspect","pass":9,"total":9,"status":"ok"},
     {"name":"par","pass":7,"total":7,"status":"ok"},
     {"name":"dynreg","pass":5,"total":5,"status":"ok"},
-    {"name":"account","pass":7,"total":7,"status":"ok"}
+    {"name":"account","pass":11,"total":11,"status":"ok"}
   ]
 }