Revoke the current JWT access token (server-side denylist).

Add the current JWT jti to the Redis denylist.

Callers must pass a valid JWT in Authorization: Bearer header. On success (HTTP 200) the token is invalidated immediately — subsequent requests using the same token will receive 401 token_revoked.

Fail-closed: if Redis is unavailable the endpoint returns 503 (unlike is_revoked which is fail-open). A failed revocation is a security regression so we surface the error rather than silently skip it (per token_denylist.py docstring).

ADR-019 prefix dispatch: this endpoint is JWT-only. Requests with an API key Bearer value (adsh_* / mne_*) receive 401 invalid_token — API keys have their own revocation path (DELETE /v1/api-keys/{id}).