Disables authenticator-app MFA for the caller by deleting the enrolled secret. Requires the account password in the request body as confirmation — there is no OTP step-up on this route, so the password is what stops a hijacked session from silently stripping MFA. No TOTP code is required, so a user who lost their device can still remove it. Idempotent once the password checks out — returns 204 whether or not an authenticator was enrolled.