Purge revoked keys and delete tenant docs left with no keys.

Operator housekeeping for the Mission Control subscriber table:

1. Hard-delete every API-key doc that has revoked_at set.
2. Delete any tenant doc that, afterwards, has no remaining keys — UNLESS it is protected (main etc.) or still flagged is_admin (our infra agents, which may have no customer-issued key but must never vanish).

Pass {"dry_run": true} to preview what would be removed without writing.