Revoke an evidence grant

Stamps revokedAt and KEEPS the row for audit (GDPR erasure hard-deletes instead — a revoked grant still names its owner). IDEMPOTENT: an already-revoked grant answers exactly like a freshly revoked one, keeping its original timestamp, so a retry is indistinguishable from the first call. Ownership is co-equal (0122): any owner of the grant’s asset may revoke any grant on it, including the last one — which is how an asset is administratively killed (the raw-read gateway then denies every read, minted URLs included). Revocation only ever removes access. Acting requires the caller to pass the raw-read gateway’s own fences over the asset: tenant (the lookup runs inside the authenticated tenant), liveness (not tombstoned, quarantine clean-or-absent, retention horizon not already past), OWNERSHIP (at least one live grant exists, and a user-bound key must hold the end user’s own live user grant), and the media-PII polarity (unclassified blocked, [] open, classified needs brain:read_media) — nobody shares what they cannot read. The byte-delivery steps are deliberately NOT applied (no bytes move here), so a metadata-only external asset is shareable; every serve still re-runs the full gateway ladder against the grantee. Any denial is the same bare 404 — unknown, foreign and forbidden are indistinguishable. 404 until EVIDENCE_GRANTS_API_ENABLED=1 AND EVIDENCE_SUBSTRATE_ENABLED=1 (raised in a guard, before body validation could reveal the route). Source: src/evidence/evidence-grants.controller.ts.

Required scope: brain:write.