I would recommend tombstoning instead of deleting, just to make sure nobody else can make an account with your name. Delete all the posts, disable tagging, etc, leave a single post up that says where to find you elsewhere.
There's always a risk using query strings so it depends on what it's for. This is also only affecting cookies so you can still make API requests across domains if things are set up right.
I don't see a mention of the "easy" option of just redirecting to the IdP to get a new token. With a well-configured IdP, that redirect step is almost instantaneous. And if you say it's not, chances are the fault is with the SPA loading too slow, so go fix that first.
It seems like Quoteback is a tool to make fancy looking blockquotes that you can put into your own blog post? If your blog sends webmentions then it would Just Work™ right?