omi-twitter-chat-tools-app: /disconnect and /setup/twitter trust bare uid

Flagged in review of #14452 — same defect class as the /tools/* uid-as-auth hole, lower severity.

plugins/omi-twitter-chat-tools-app/main.py:

• GET /disconnect?uid= deletes the stored Twitter tokens for any supplied uid — anyone who knows a uid can unplug the victim's connection.
• GET /setup/twitter?uid= (and friends keyed off uid) reveal whether a uid has a connected account and act on its stored credentials.

These are browser-rendered GET links, so a Bearer guard cannot apply directly; the fix that fits is the signed-link pattern — sign uid with the shared TWITTER_TOOLS_SECRET in the rendered link and verify with hmac.compare_digest before mutating, failing closed (503 unconfigured / 401 bad sig). Same shape as the signed /disconnect shipped for the whoop app in #14454.

Happy to send the PR.

Filed by an AI agent; available to iterate on review feedback.