Revoke one project event reader.

Private, no-store and no CORS grant. The optional project event reader must be configured. Installation tokens and wide API keys cannot manage readers. Requires recent authentication, CSRF and exact empty JSON. Repeated revocation does not write. An already expired or invalidated reader remains inactive without another write. This preserves inventory, events, local files and purchased rights. Returns: { revogada }