Revokes a tunnel token outright (no replacement). Cuts web-AI access immediately: the relay stops accepting it and the cloud connector rejects its sessions. The token is the credential — same trust model as /tunnel/rotate, only its holder can revoke it. To reconnect later, the local server issues a fresh token on its next registration (delete cloud_token in config.json + restart).

lmcp-api#269: the presented token always revokes itself. The machine's OTHER live tokens go too only when the machine's live device key vouches for the presented token (_token_vouched_by_live_key). This used to revoke every live token of the machine on any of them, and register-anon mints one for any machine_id without authentication, so anyone could cut a machine's relay. The answer keeps {revoked, next} and adds revoked_count; the only caller is the Mac uninstaller (mac/uninstall.sh and lmcp-admin's served copy), which reads curl's exit status only.