MCP `token_revoke`: revoke one of the caller's own API tokens, with the same rules as DELETE /api/v1/tokens/{id} #5476

For: a leaked token is revoked from wherever the owner is. The route (src/http/api.ts:2181) and the page (tokenDelete) call deleteToken(app, user, id).

Done:

• [ ] A tool token_revoke { id } calls deleteToken(app, caller, id). It answers { id, says: "Token revoked." }. An unknown id, or another person's token, is "No such token."
• [ ] test/mcp-token-revoke.test.ts covers three cases: a revoked token no longer authenticates; another person's token id is refused and still works; revoking the token making the call itself is allowed, and the next call with it is refused. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations.
• [ ] Before pushing, run test/mcp-token-revoke.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-token-revoke.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence. #5462 and #5461 add tools nearby; any order works.

Closed: already done on main in 885f055e (pull #5487).