`DELETE /apps/{id}` — soft-delete + cascade revoke every key the app holds. The row stays for audit; the extractor rejects api-key auth against revoked keys, and the app's `status = "inactive"` is the operator-visible state in the admin UI.

curl -X DELETE "https://example.com/apps/string"