Revoke one tenant-admin token by id. Takes effect on the next request (token lookup reads the in-memory registry, which the upsert updates) and survives a restart (JSONL replay keeps the last line per hash). Idempotent: revoking a revoked token is 200 with already_revoked.

Revoking the token the request itself is authenticated with locks the caller out, so it must be explicit: without ?confirm=self it is refused 409 confirm_self_revoke and nothing changes.