Delete oauth_refresh_token families that are terminally dead (revoked 7d+).

Its own route rather than folded into a hot reconcile, for the same reason as github-webhooks/retention: nothing here is on a critical path, so it must never compete for another tick's budget. Bounded per call and a strict no-op once the backlog is clear, so it is safe on every tick. Only families with no live handle are eligible -- see app/oauth/retention.