App frames: store.proxy.disconnect({platform}) removes this app's delegation

[michielbdejong]

Closes #1736

Stacked on #1744 (claude/frame-open-external), which is stacked on #1733.

store.proxy.disconnect({ platform }) → { status: 'disconnected', platform, connectionIds }

An app can now let go of an integration-proxy platform it connected. Notion and timesheets hid Disconnect until this existed.

• Only this app's delegation. The host (ProxyConnections.disconnectApp, reusing delegated() and undelegate() in proxyConnections.ts) sends one DELETE /connections/{id}/agents/{app agent} for each platform connection delegated to this app, signed with the user's key. A 404 counts as already gone.
• Never the whole connection. revoke() (DELETE /connections/{id}) is not reachable from a frame. Other apps may share the connection, so deleting it stays a page action.
• Installations: the recorded integrationConnections[platform] is undelegated too, even if the proxy no longer lists it as this app's. The key is then removed with forgetInstallationConnection, the same way Installation page: connect proxy platforms, and no proxy calls without one (#1700) #1733's Disconnect does it: other platforms are kept, and the property is removed once it is empty. A createApp app writes nothing.
• The frame drops its cached capabilities for that platform. The next request asks the host again, and the host refuses it.
• Protocol: new proxyDisconnect op. ProxyDisconnectResult is exported from @tomic/plugin. Docs are in the "App frames" section of custom-views.md.

No UI text, so no catalog changes.

Tests

• helpers/proxyConnections.test.ts, against the fake proxy that verifies every v2 signature:
  • only DELETE …/agents/{app} calls are sent;
  • another app's delegation on the same connection is kept;
  • both connections still exist afterwards;
  • a 404 on a recorded id is fine;
  • an invalid platform is refused before any call.
• chunks/AppPage/hostStore.test.ts:
  • proxyDisconnect passes the Installation's recorded id and removes only that platform's key;
  • nothing is written for a createApp app;
  • it refuses without a proxy or with a bad platform.
• browser/plugin/src/viewProtocol.test.ts: the op is on the wire, and the frame forgets its cached capability.

🤖 Generated with Claude Code

[michielbdejong]

Merge-risk triage (2026-09-28). This is a read-only review of this PR's own diff. The rule it applies: nothing that works today may break for existing users or clients, and new behaviour is added alongside the old. The stack is being rebased onto develop as one chain before merging, so line references are against the current stacked base.

Verdict: SAFE

Needs no click, but it can only remove this app's own delegation (undelegate(id, appAgent); a 404 counts as already gone). It never deletes connections, and it only forgets integrationConnections[platform] on the app's own Installation, written as the person.

🤖 Generated with Claude Code