Revoke the calling token

Connected MCP/OAuth clients appear as `kind: "oauth"`; revoking one signs that client out (access and refresh tokens). There is no create route: an agent token cannot mint tokens, so it can never escalate its own scopes or outlive its revocation. Create tokens from a signed-in session or `notify auth login`.