identity: "disconnect app" — revoke_app(Subject, Client) (+4 tests)

identity_tokens:revoke_app(Subject, Client) revokes every grant a subject
holds for one client at once (audited one revoke per grant), exposed at the
facade as identity:revoke_app. The action counterpart to the grants view —
completing the account-security view+action pairs (sessions/logout_all,
grants/revoke_app, history). Other subjects' same-client grants are
untouched. account 11/11, 233/233.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,6 +1,6 @@
 # identity-on-sx Scoreboard
 
-**Total: 229 / 229 tests passing**
+**Total: 233 / 233 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
@@ -25,7 +25,7 @@
 | ✅ | introspect | 9 | 9 |
 | ✅ | par | 7 | 7 |
 | ✅ | dynreg | 5 | 5 |
-| ✅ | account | 7 | 7 |
+| ✅ | account | 11 | 11 |
 
 
 Generated by `lib/identity/conformance.sh`.