Oauth Revoke

RFC 7009 token revocation — ADR-2026-08-01 clause 5.

Proxies revocation to Auth0 and drops our matching grant rows. This is what lets a client's "disconnect" actually kill the long-lived credential rather than merely forgetting it.

Bounded on purpose: revoking a refresh token does NOT end the session. The outstanding access token stays valid until exp (24h in prod) plus up to 30 min of middleware token cache. That bound exists today for every access token; this endpoint does not widen it and does not claim to close it.

Per RFC 7009 §2.2 an unknown or already-revoked token is a SUCCESS, not an error — otherwise the endpoint becomes a token-validity oracle.