Revocation feed for stateless relying parties (meta-copilot).

Meta validates its own JWT per-request and never re-contacts pozeidon after login, so pozeidon's force-logout can't reach it by the refresh path the cookie copilots use. Meta instead polls this feed and mirrors each row into its own per-request denylist, keyed by revoked_after vs the token's iat.