Revoke Key

Stamp revoked_at on a key row. Idempotent; returns whether the UPDATE actually wrote (True for the first call, False thereafter).

The path parameter is the full sha256 hash returned by GET /keys — NOT the prefix. This is intentional: a prefix is enough to identify a key visually but not enough to revoke one accidentally.

B-AUTH-AUDIT (R1 F4 + R12 F2, 2026-05-17): requires a session issued within the last 60 minutes (step-up) and an Origin/Referer that matches the etymolt allowlist. Writes an audit_log row.