Logout user by revoking the device's refresh-token chain.

Revoking the whole (user_id, device_id) family — not just the presented token — is load-bearing: with rotating refresh tokens, predecessors of the current tail still sit in the table until the grace-window sweep prunes them. A bare revoke_by_token_hash of just the tail would leave those predecessors live (the FK's ON DELETE SET NULL nulls their superseded_by_id), so a replay during the grace window would walk the now-orphaned predecessor as if it were the tail and resurrect the session.