Revoke Extension Credential Route

Delete the presented credential; the extension calls this on sign-out.

Deliberately not flag-gated: cleanup must keep working for a user whose flag was just turned off. Idempotent — revoking twice reports revoked=false the second time because the credential no longer authenticates.