Revoke assets (batch)

Revoke the proofs of up to 25 assets — any mix of phone, email and domain — with ONE step-up code. Revoking withdraws PROOFS, not the identifier: a phone or email row stays active (signing in with it again issues a new proof). Revoking one asset of a phone or email revokes every asset of that identifier. Revoking a DOMAIN asset runs the whole-domain cascade: every proof of the domain and every delegation issued from it are revoked, and the domain is demoted to reverification_required with its DNS challenge rotated. Cannot be undone. Owner only: an API key answers 403 owner_session_required for every asset type (revoke the proof itself with POST /proofs/{id}/revoke instead). A session needs a single-use revocation_bulk step-up grant bound to exactly the ids it sends (403 2fa_required; reason: target_mismatch when the grant names other ids). A notice goes to the owner. Per-item outcomes; idempotent on retry (an already-revoked id counts as done, an unknown one as not_found, and a batch with nothing left to revoke spends no grant). Owner session only — this route sits below the session gate, so an API key is refused 401. Projects and the account have no batch form.