A harness that disconnects revokes its token: POST /oauth/revoke (RFC 7009) and revocation_endpoint in the metadata #8360

Disconnecting Claude, OpenCode or a phone assistant from the forge actually ends its access. Today /.well-known/oauth-authorization-server names no revocation endpoint and src/http/oauth.ts has none. A token minted through OAuth lives until it expires or someone deletes it in settings.

Done:

• [ ] POST /oauth/revoke takes token (form-encoded, public client, as /oauth/token does). It revokes the token if it was minted by OAuth, and answers 200 with no body either way (RFC 7009 §2.2: an unknown token is not an error). It is rate-limited like /oauth/token.
• [ ] Both metadata documents (oauth-authorization-server and openid-configuration, src/http/oauth.ts:128 and :160) name revocation_endpoint.
• [ ] A revoked token gets 401 from /mcp and /api/v1 on its next call, and the revocation is on the account's audit trail.
• [ ] A test covers revoke → 401, an unknown token → 200, and a non-OAuth personal token is not revocable through this route.

Files: src/http/oauth.ts, src/core/oauth.ts, a new test/oauth-revoke.test.ts. Risk: the route takes no session, so it must never reveal whether a token existed. Same answer, similar time.