Disable a service account (stop token issuance)

Disables the selected service account (UI "Disable" on the detail header and in list row menus; also a bulk action over selected rows). While disabled the account stops issuing tokens immediately — the UI toast reads "Service account disabled — token issuance stopped" — and the list/detail badge flips to the stopped channel. The resulting state is visible to subsequent reads. Credential revocation: in the same transaction every non-revoked key of the account turns terminal revoked and every ACTIVE API token (pc_live_…) the account holds or created turns REVOKED; each one fails authentication (401) from the next request. Re-enabling the account does NOT revive them — new keys must be minted. When anything was revoked, a SUCCEEDED iam.service_account.credentials.revoke Operation is recorded for the activity/audit feed. Validation: account must exist and be visible in the scope (else 404 NOT_FOUND); current state must permit disable — an account already in disabled is rejected as a state conflict → 409 CONFLICT; caller must hold an IAM command permission (owner|admin) else 403 FORBIDDEN. Async & state: Applied inline — the status flips to disabled at once and a terminal, already- SUCCEEDED tracking Operation is returned (202) so a later GET /operations/{id} resolves it as done and the acting principal is stamped for the activity/audit feed. Errors: 401 unauthenticated; 403 lacks command permission; 404 unknown account; 409 CONFLICT when the account is already disabled or a concurrent state change is in flight; 500 command execution failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replay of the same key returns the original Operation so UI retries are safe and the account is not double-transitioned.