Disconnect one MCP client as the Bearer actor

Machine route (apikey + user Bearer; auth.grants.revoke(id) in @run402/functions). Ends one grant of the user identified by the token: its refresh token and every access token it issued are refused on the next request, so the client's next /_run402/mcp call gets the 401 sign-in challenge. Another user's grant, a browser session id, or an ended grant answers revoked: false. No recent sign-in is required.