Revoke Entitlement

Revoke an entitlement — the admin counterpart of /memory/entitlements/grant (ACC-039: a grant made through the pre-Stage-A hole had no way back). Global admin only. Body: {kind, id, subject, tenant? (item grants), reason}. Emits a plain entitlement.revoked — no dispute id, so it never tombstones an acquired copy (that is the refund path's job). It does bar a chargeback won later, before or after it, from reinstating what it withdrew (#1165).