Revoke OAuth grant

Revoke a consent→agent grant — one of the three revocation kill radii.

Allowed for the grant's owner (the consenting user) or an admin. Marks the grant revoked and revokes every outstanding access/refresh token minted under it in the same transaction; the live resolvers also re-check grant status on every verdict (belt + braces). The client's next token use or refresh fails closed. Idempotent on an already-revoked grant.