Deauthorizes a subject by revoking every outstanding credential your organization minted for it — the person (principal_ref) or the business (business_ref), whichever the request names. Revocation flips the credentials' bits on the published status list, so relying parties that check status see the deauthorization within the list's cache TTL. Idempotent: re-revoking an already-revoked subject reports zero.